Method and system for online application of secret-related surveying and mapping result in non-secret-related network

Abstract

The invention relates to the technical field of encrypted data processing, and discloses a method and system for online application of secret-related surveying and mapping results in a non-secret-related network, and the method comprises the steps: carrying out the decryption processing of a data entity needed by a second network in a first network, obtaining a first type of data, and deploying the first type of data to the second network; the first type of data comprises non-confidential surveying and mapping result data of which the range is greater than a first threshold value and the precision is lower than a second threshold value; constructing a logic data set based on the first type of data in the second network, and executing a service separated from the entity through the logic data set; on the basis of a gatekeeper and a preset operation strategy, executing an online service of mixing the first type of data and the second type of data in a second network; the second type of data comprises non-confidential surveying and mapping result data of which the range is smaller than a first threshold value and the precision is higher than a second threshold value in the first network. According to the method, high-efficiency online application of the secret-related surveying and mapping result in the external network can be realized, the application field of the surveying and mapping result is greatly expanded, and the effect of the surveying and mapping result is fully played.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted data processing, and in particular to a method and system for online application of confidential surveying and mapping results on a non-confidential network. Background Art

[0002] There are currently two ways to use confidential surveying and mapping results in non-confidential networks (external networks): For confidential surveying and mapping results exceeding 25 square kilometers, an irreversible spatial position deformation processing method is generally used to convert confidential data into non-confidential data for use. This method greatly reduces the usability of surveying and mapping results, and applications that require high-precision surveying and mapping results cannot be carried out. In many areas where they have to be applied, there are still cases of illegal use.

[0003] For confidential surveying and mapping results of less than 25 square kilometers, they are usually copied from the confidential network (intranet) to the external network for use. This method not only limits the spatial scope of application, but also makes it impossible to effectively use the internal network information system. The limited confidential data stored in various places on the external network computers are difficult to manage, and if accumulated, there will be a great risk of leakage.

[0004] In addition, in terms of patent technology, the invention patent document CN115630907A discloses a method for automatically distributing surveying and mapping results based on a heterogeneous network, including the following steps: Step 1, scanning the storage path of confidential intranet results data; Step 2, exporting a result directory metadata package with a unique identification code from the confidential intranet; Step 3, external network users query and apply for the required surveying and mapping results; Step 4, reading and parsing order file information in the confidential intranet. The core of this method is "result directory metadata with a unique identification code". By publishing the non-confidential directory metadata of the intranet on the external network, the external network uses it to select the intranet data to form an order; the intranet queries and captures confidential data according to the order to form distribution data. However, this method uses an offline copy method to realize the exchange of "result directory metadata with a unique identification code" and orders between the internal and external networks, which can only realize the distribution of confidential results, and has limitations in practical application. Summary of the invention

[0005] Since confidential surveying and mapping results can only be applied in the external network by two simple methods: large-scale data deformation processing and small-scale data copying, this will bring about problems such as limited application, inconvenience in use, and difficulty in online application. In order to solve the above problems, the present invention proposes a method and system for online application of confidential surveying and mapping results in a non-confidential network, which can realize the high-efficiency online application of confidential surveying and mapping results in the external network, greatly expand the application field of surveying and mapping results, and give full play to the role of surveying and mapping results.

[0006] The technical solution adopted by the present invention is as follows: A method for applying confidential surveying and mapping results online on a non-confidential network, comprising: Declassifying the data entities required by the second network in the first network to obtain the first type of data, and deploying it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; A logical data set is constructed within the second network based on the first type of data, and services separated from the entity are executed through the logical data set; based on the network gate and preset operation policies, online services in the second network that mix the first type of data and the second type of data are executed; the second type of data includes non-confidential surveying and mapping results data within the first network whose range is smaller than the first threshold and whose accuracy is higher than the second threshold.

[0007] Furthermore, the first threshold includes a spatial range restriction on the public application of confidential surveying and mapping results data; the second threshold includes a precision restriction on the public application of confidential surveying and mapping results data; the logical data set includes a data condition set that records the data range and precision required for the service, which can realize one set of data entities supporting multiple services, and multiple sets of data entities supporting one service.

[0008] Furthermore, the operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result to achieve binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

[0009] Furthermore, the online service of performing a mixture of the first category data and the second category data on the second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, directly reading the first category data of the second network; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, reading the second category data in the first network through the network gate and a preset operation strategy.

[0010] Furthermore, the online service of the second type of data in the second network is realized through the network gate and the preset operation strategy, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

[0011] A system for online application of confidential surveying and mapping results on a non-confidential network, comprising a first network, a second network and a network gate, wherein the first network and the second network are connected via the network gate; The first network is configured to declassify the data entity required by the second network to obtain the first type of data, and deploy it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; The second network is configured to construct a logical data set based on the first type of data, and execute services separated from the entity through the logical data set; based on the network gate and preset operation policies, execute online services in the second network that mix the first type of data and the second type of data; the second type of data includes non-confidential surveying and mapping results data within the first network with a range smaller than a first threshold and an accuracy higher than a second threshold.

[0012] Furthermore, the first threshold includes a spatial range restriction on the public application of confidential surveying and mapping results data; the second threshold includes a precision restriction on the public application of confidential surveying and mapping results data; the logical data set includes a data condition set that records the data range and precision required for the service, which can realize one set of data entities supporting multiple services, and multiple sets of data entities supporting one service.

[0013] Furthermore, the operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result to achieve binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

[0014] Furthermore, the online service of performing a mixture of the first category data and the second category data on the second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, directly reading the first category data of the second network; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, reading the second category data in the first network through the network gate and a preset operation strategy.

[0015] Furthermore, the online service of the second type of data in the second network is realized through the network gate and the preset operation strategy, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

[0016] The beneficial effects of the present invention are: (1) Compared with the existing technology that confidential data can only be applied online in the intranet, or that copies limited data to the external network for application, the present invention overcomes the problem that the network gate can only perform non-protocol ferrying of data files and the external network cannot directly operate the intranet data through the network gate ferry file analysis, thereby realizing the online application of limited confidential data that meets the confidentiality requirements; at the same time, by taking advantage of the fact that confidential data meets the confidentiality requirements of a limited range during application, the online application of a large range of confidential data is realized.

[0017] (2) Compared with the invention patent document CN115630907A, the present invention realizes online data exchange between the internal and external networks with the help of a network gate, and with the help of limited confidential data, it can be legally used on the external network, and with the help of rules, it can complete the online operation of external network data query requests on the internal network, so as to realize the online service of limited confidential data on the internal network through the external network. Based on the present invention, only one network gate is needed to realize the relevant functions for distributing confidential achievements, and it is online, without the need to copy any content offline. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic diagram of the operation content of the preset operation strategy in Example 1 of the present invention.

[0019] Figure 2 It is a flow chart of a method for applying confidential surveying and mapping results online on a non-confidential network according to embodiment 1 of the present invention. DETAILED DESCRIPTION

[0020] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific implementation methods of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the embodiments described are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0021] Example 1 Since confidential surveying and mapping results can only be applied on the external network using two simple methods: large-scale data deformation processing and small-scale data copying, this will bring about problems such as limited application, inconvenience in use, and difficulty in online application.

[0022] Based on this, this embodiment provides a method for applying confidential surveying and mapping results online on a non-confidential network, including: Declassifying the data entities required by the second network in the first network to obtain the first type of data, and deploying it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than the first threshold and an accuracy lower than the second threshold; A logical data set is constructed within the second network based on the first type of data, and services separated from the entity are executed through the logical data set; based on the network gateway and preset operation policies, online services in the second network that mix the first type of data and the second type of data are executed; the second type of data includes non-confidential surveying and mapping results data within the first network whose range is smaller than the first threshold and whose accuracy is higher than the second threshold.

[0023] Preferably, the first threshold is the spatial range limit for the public application of confidential surveying and mapping results data, and the second threshold is the accuracy limit for the public application of confidential surveying and mapping results data; the logical data set includes a data condition set that records the data range and accuracy required for the service, which can realize one set of data entities supporting multiple services, and multiple sets of data entities supporting one service.

[0024] like Figure 1 As shown, the operation content of the preset operation strategy may specifically include an operation identification code and a data condition. The operation identification code represents the transmission of the operation result, expressed by the file name, and realizes the binding with the operation request corresponding to the second network; the data condition represents the content of the required query data.

[0025] Preferably, an online service in which the first category of data and the second category of data are mixed in the second network is executed, comprising: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, the first category of data from the second network is directly read; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, the second category of data in the first network is read through the network gate and a preset operation strategy.

[0026] More preferably, the online service of the second type of data on the second network is realized through the network gate and the preset operation strategy, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

[0027] like Figure 2As shown, taking the first network as a confidential network (i.e., an intranet) and the second network as a non-confidential network (i.e., an extranet) as an example, the service construction and request of the second type of data in this embodiment are further explained, which can be implemented by the following steps: The external network information service module generates an external network information transmission file according to the service application requirements, the required high-precision data range and scale, etc., through the external network information generation module according to the preset operation strategy, and the external network information transmission module sends it to the network gate, which is then transferred to the internal network; The intranet information monitoring and transmission module continuously scans the network gate ferry folder, and when new files are found, they are passed to the intranet information parsing module, which translates them into specific operation commands; If the operation command belongs to service construction, the intranet service data generation module is called to query the intranet related database, build the data-free entity required by the service, and ferry the non-confidential logical data set file named by the operation identification code to the external network through the network gate. The external network information monitoring and transmission module scans the external network ferry folder, and after finding the logical data set file named by the corresponding operation identification code, it uses it to build the entity-free service; If the operation command belongs to a service request, the intranet service data generation module is called to query the intranet related database, dynamically generate the tiles required for the service, construct a small range of non-confidential tile data named by the operation identification code, and ferry it to the external network through the network gate. The external network information monitoring and transmission module scans the external network ferry folder, finds a tile file named with the corresponding operation identification code, and sends it to the service request. This step can establish a cache to improve efficiency, but its range is controlled within 25 square kilometers to meet confidentiality requirements.

[0028] In summary, the method of this embodiment uses logical data sets to separate data entities from services, which can solve the problem of building confidential data services in the internal network on the external network; using limited confidential data, it can realize the online application of a large range of confidential data in non-confidential networks; using ferry file analysis, it can realize online operation of internal network data through the external network through the network gate.

[0029] Example 2 A system for applying confidential surveying and mapping results online on a non-confidential network, comprising a first network, a second network and a network gate, wherein the first network and the second network are connected via the network gate; The first network is configured to declassify the data entity required by the second network to obtain the first type of data, and deploy it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; The second network is configured to construct a logical data set based on the first category of data, and execute services separated from the entity through the logical data set; based on the network gate and preset operation policies, execute online services in the second network that mix the first category of data and the second category of data; the second category of data includes non-confidential surveying and mapping results data within the first network with a range smaller than the first threshold and an accuracy higher than the second threshold.

[0030] Preferably, the first threshold includes the spatial range restriction on the public application of confidential surveying and mapping results data; the second threshold includes the accuracy restriction on the public application of confidential surveying and mapping results data; the logical data set includes a data condition set that records the data range and accuracy required for the service, which can realize one set of data entities supporting multiple services, and multiple sets of data entities supporting one service.

[0031] Preferably, the operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result to achieve binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

[0032] Preferably, an online service in which the first category of data and the second category of data are mixed in the second network is executed, comprising: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, the first category of data from the second network is directly read; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, the second category of data in the first network is read through the network gate and a preset operation strategy.

[0033] Preferably, the online service of the second type of data in the second network is realized through the network gate and the preset operation strategy, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

[0034] In summary, the method and system for online application of confidential surveying and mapping results on a non-confidential network of the present invention have the following characteristics: 1) Using a network gate is a physical isolation device to achieve online connection between internal and external networks.

[0035] 2) Through application scenario analysis, we can conclude that the application space of most confidential data is limited. We can use the regulations that limited confidential data can be run on the external network to realize the application of confidential data on the external network.

[0036] 3) A preset operation strategy is proposed. Breaking through the network firewall can only carry out data ferrying, and does not support confidentiality control of public protocol information transmission, so as to achieve online query of internal and external network data and limited confidential data application in accordance with confidentiality regulations.

[0037] 4) An online data service method combining external network logical data sets and internal network data entities is proposed to realize the online application of limited confidential data.

[0038] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Claims

1. A method for applying confidential surveying and mapping results online on a non-confidential network, characterized in that: include: Declassifying the data entities required by the second network in the first network to obtain the first type of data, and deploying it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; A logical data set is constructed within the second network based on the first type of data, and services separated from the entity are executed through the logical data set; based on the network gate and preset operation policies, online services in the second network that mix the first type of data and the second type of data are executed; the second type of data includes non-confidential surveying and mapping results data within the first network whose range is smaller than the first threshold and whose accuracy is higher than the second threshold.

2. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 1, characterized in that: The first threshold includes the spatial range limit of the public application of confidential surveying and mapping results data; The second threshold includes the accuracy limit of the confidential surveying and mapping results data that can be publicly applied; The logical data set includes a data condition set that records the data range and accuracy required by the service, and can realize that one set of data entities supports multiple services, and multiple sets of data entities support one service.

3. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 1, characterized in that: The operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result, realizes binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

4. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 1, characterized in that: The online service of performing a mixture of first-category data and second-category data on a second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, directly reading the first-category data of the second network; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, reading the second-category data in the first network through a network gate and a preset operation strategy.

5. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 4, characterized in that: The online services of the second type of data in the second network are realized through the network gate and preset operation strategies, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

6. A system for applying confidential surveying and mapping results online on a non-confidential network, characterized in that: It includes a first network, a second network and a network gate, wherein the first network and the second network are connected via the network gate; The first network is configured to declassify the data entity required by the second network to obtain the first type of data, and deploy it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; The second network is configured to construct a logical data set based on the first type of data, and execute services separated from the entity through the logical data set; based on the network gate and preset operation policies, execute online services in the second network that mix the first type of data and the second type of data; the second type of data includes non-confidential surveying and mapping results data within the first network with a range smaller than a first threshold and an accuracy higher than a second threshold.

7. The system for applying confidential surveying and mapping results online on a non-confidential network according to claim 6, characterized in that: The first threshold includes the spatial range limit of the public application of confidential surveying and mapping results data; The second threshold includes the accuracy limit of the confidential surveying and mapping results data that can be publicly applied; The logical data set includes a data condition set that records the data range and accuracy required by the service, and can realize that one set of data entities supports multiple services, and multiple sets of data entities support one service.

8. The system for applying confidential surveying and mapping results online on a non-confidential network according to claim 6, characterized in that: The operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result, realizes binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

9. The system for applying confidential surveying and mapping results online on a non-confidential network according to claim 6, characterized in that: The online service of performing a mixture of first-category data and second-category data on a second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, directly reading the first-category data of the second network; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, reading the second-category data in the first network through a network gate and a preset operation strategy.

10. A system for applying confidential surveying and mapping results online on a non-confidential network according to claim 9, characterized in that: The online services of the second type of data in the second network are realized through the network gate and preset operation strategies, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

Images