A method and system for online application of classified surveying and mapping results in a non-classified network

Abstract

The present invention relates to the technical field of encrypted data processing, and discloses a method and system for online application of classified surveying and mapping results in a non-classified network. The method includes: decrypting data entities required by a second network in a first network to obtain a first type of data, and deploying the first type of data to the second network; the first type of data includes non-classified surveying and mapping result data with a range greater than a first threshold and a precision lower than a second threshold; constructing a logical data set based on the first type of data in the second network, and executing a service separated from the entity through the logical data set; based on a network isolation device and a preset operation policy, executing an online service in the second network with the mixture of the first type of data and a second type of data; the second type of data includes non-classified surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold in the first network. The present invention can achieve efficient online application of classified surveying and mapping results in an external network, greatly expand the application field of surveying and mapping results, and give full play to the role of surveying and mapping results.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted data processing, and in particular to a method and system for online application of confidential surveying and mapping results on a non-confidential network. Background Art

[0002] There are currently two ways to use confidential surveying and mapping results in non-confidential networks (external networks):

[0003] For confidential surveying and mapping results exceeding 25 square kilometers, an irreversible spatial position deformation processing method is generally used to convert confidential data into non-confidential data for use. This method greatly reduces the usability of surveying and mapping results, and applications that require high-precision surveying and mapping results cannot be carried out. In many areas where they have to be applied, there are still cases of illegal use.

[0004] For confidential surveying and mapping results of less than 25 square kilometers, they are usually copied from the confidential network (intranet) to the external network for use. This method not only limits the spatial scope of application, but also makes it impossible to effectively use the internal network information system. The limited confidential data stored in various places on the external network computers are difficult to manage, and if accumulated, there will be a great risk of leakage.

[0005] In addition, in terms of patent technology, the invention patent document CN115630907A discloses a method for automatically distributing surveying and mapping results based on a heterogeneous network, including the following steps: Step 1, scanning the storage path of confidential intranet results data; Step 2, exporting a result directory metadata package with a unique identification code from the confidential intranet; Step 3, external network users query and apply for the required surveying and mapping results; Step 4, reading and parsing order file information in the confidential intranet. The core of this method is "result directory metadata with a unique identification code". By publishing the non-confidential directory metadata of the intranet on the external network, the external network uses it to select the intranet data to form an order; the intranet queries and captures confidential data according to the order to form distribution data. However, this method uses an offline copy method to realize the exchange of "result directory metadata with a unique identification code" and orders between the internal and external networks, which can only realize the distribution of confidential results, and has limitations in practical application. Summary of the invention

[0006] Since confidential surveying and mapping results can only be applied in the external network by two simple methods: large-scale data deformation processing and small-scale data copying, this will bring about problems such as limited application, inconvenience in use, and difficulty in online application. In order to solve the above problems, the present invention proposes a method and system for online application of confidential surveying and mapping results in a non-confidential network, which can realize the high-efficiency online application of confidential surveying and mapping results in the external network, greatly expand the application field of surveying and mapping results, and give full play to the role of surveying and mapping results.

[0007] The technical solution adopted by the present invention is as follows:

[0008] A method for online application of classified surveying and mapping results in a non-classified network, including:

[0009] Decrypt the data entities required by the second network in the first network to obtain the first type of data, and deploy it to the second network; the first type of data includes non-classified surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold;

[0010] Build a logical data set based on the first type of data in the second network, and execute services separated from the entities through the logical data set; based on the network isolation device and the preset operation strategy, execute the online service of the mixture of the first type of data and the second type of data in the second network; the second type of data includes non-classified surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold in the first network.

[0011] Furthermore, the first threshold includes the spatial range limit for the public application of classified surveying and mapping result data; the second threshold includes the precision limit for the public application of classified surveying and mapping result data; the logical data set includes a data condition set that records the data range and precision required for the service, and can realize that a set of data entities supports multiple services, and multiple sets of data entities support one service.

[0012] Furthermore, the operation content of the preset operation strategy includes an operation identification code and data conditions; the operation identification code represents the transmission of the operation result, realizes the binding with the operation request corresponding to the second network, and the transmission method includes expressing through the file name; the data conditions represent the content of the data to be queried.

[0013] Furthermore, the execution of the online service of the mixture of the first type of data and the second type of data in the second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold, directly read the first type of data in the second network; when the required data is surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold, read the second type of data in the first network through the network isolation device and the preset operation strategy.

[0014] Furthermore, realizing the online service of the second type of data in the second network through the network isolation device and the preset operation strategy includes:

[0015] The second network generates a second network information transfer file according to the service request and the data conditions of the required second type of data according to the preset operation strategy, and sends it to the transfer folder of the network isolation device;

[0016] The first network scans the transfer folder of the network isolation device, after discovering a new file, parses the corresponding operation command, queries the relevant database in the first network, and sends the query result to the transfer folder of the network isolation device;

[0017] After the ferry folder of the second network scanning network isolation device discovers the preset range of the second type of data files named with the corresponding operation identification code, it reads and generates tile data and sends it to the service request.

[0018] A system for online application of classified surveying and mapping results in a non-classified network, including a first network, a second network, and a network isolation device. The first network and the second network are connected through the network isolation device;

[0019] The first network is configured to decrypt the data entities required by the second network to obtain the first type of data and deploy it to the second network; the first type of data includes non-classified surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold;

[0020] The second network is configured to construct a logical data set based on the first type of data and execute services separated from the entities through the logical data set; based on the network isolation device and the preset operation policy, execute the online service of the mixture of the first type of data and the second type of data in the second network; the second type of data includes non-classified surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold within the first network.

[0021] Further, the first threshold includes the spatial range limit for the public application of classified surveying and mapping result data; the second threshold includes the precision limit for the public application of classified surveying and mapping result data; the logical data set includes a data condition set that records the data range and precision required for the service, and can realize that a set of data entities supports multiple services, and multiple sets of data entities support one service.

[0022] Further, the operation content of the preset operation policy includes an operation identification code and data conditions; the operation identification code represents the transmission of the operation result, realizes the binding with the operation request corresponding to the second network, and the transmission method includes expression through the file name; the data conditions represent the content of the data to be queried.

[0023] Further, the execution of the online service of the mixture of the first type of data and the second type of data in the second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold, it directly reads the first type of data in the second network; when the required data is surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold, it reads the second type of data in the first network through the network isolation device and the preset operation policy.

[0024] Further, the realization of the online service of the second type of data in the second network through the network isolation device and the preset operation policy includes:

[0025] The second network generates a second network information transfer file according to the service request for the data conditions of the required second type of data according to the preset operation policy and sends it to the ferry folder of the network isolation device;

[0026] After the first network scans the ferry folder of the network isolation device and discovers new files, it parses the corresponding operation commands, queries the relevant database of the first network, and sends the query results to the ferry folder of the network isolation device.

[0027] After the second network scans the ferry folder of the network isolation device and discovers the preset range of second-type data files named with the corresponding operation identification codes, it reads and generates tile data and sends it to the service request.

[0028] The beneficial effects of the present invention are as follows:

[0029] (1) Compared with the prior art in which confidential data applications can only be used online within the intranet or by copying limited data to the extranet for use, the present invention overcomes the problem that the network isolation device can only perform protocol-free ferry of data files and the extranet cannot directly operate the intranet data through parsing the ferry files of the network isolation device, and realizes the online application of limited confidential data that meets the confidentiality requirements; at the same time, by virtue of the characteristic that the confidential data meets the limited confidentiality requirements during application, the online application of a large range of confidential data is realized.

[0030] (2) Compared with the invention patent document CN115630907A, the present invention realizes the online data exchange between the intranet and the extranet by means of the network isolation device, realizes the legal use of limited confidential data on the extranet, and realizes the online operation of the extranet data query request within the intranet by means of rules, so as to realize the online service of limited confidential data in the intranet through the extranet. Based on the present invention for the distribution of confidential achievements, only one network isolation device can realize the relevant functions, and it is online without the need to copy any content offline. Description of the Drawings

[0031] Figure 1 It is a schematic diagram of the operation content of the preset operation strategy in Embodiment 1 of the present invention.

[0032] Figure 2 It is a flowchart of a method for online application of confidential surveying and mapping achievements in a non-secret network in Embodiment 1 of the present invention. Detailed Embodiments

[0033] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific embodiments of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0034] Embodiment 1

[0035] Since classified surveying and mapping results can only be applied to the external network by using two simple methods: large - scale data deformation processing and small - scale data copying, it will bring problems such as limited application, inconvenient use, and difficulty in online application.

[0036] Based on this, this embodiment provides a method for online application of classified surveying and mapping results in a non - classified network, including:

[0037] In the first network, decrypt the data entities required by the second network to obtain the first - type data, and deploy it to the second network; the first - type data includes non - classified surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold;

[0038] In the second network, construct a logical data set based on the first - type data, and execute services separated from the entities through the logical data set; based on the network gateway and the preset operation strategy, execute the online service of the mixture of the first - type data and the second - type data in the second network; the second - type data includes non - classified surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold in the first network.

[0039] Preferably, the first threshold is the spatial range limit for the public application of classified surveying and mapping result data, and the second threshold is the precision limit for the public application of classified surveying and mapping result data; the logical data set includes a data condition set that records the data range and precision required by the service, and can realize that one set of data entities supports multiple services, and multiple sets of data entities support one service.

[0040] As Figure 1 shown, the operation content of the preset operation strategy can specifically include an operation identification code and data conditions. Among them, the operation identification code represents the transmission of the operation result, which is expressed by the file name and realizes the binding with the operation request corresponding to the second network; the data conditions represent the content of the data to be queried.

[0041] Preferably, executing the online service of the mixture of the first - type data and the second - type data in the second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold, directly read the first - type data in the second network; when the required data is surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold, read the second - type data in the first network through the network gateway and the preset operation strategy.

[0042] More preferably, realizing the online service of the second - type data in the second network through the network gateway and the preset operation strategy includes:

[0043] The second network generates a second - network information transfer file according to the service request for the data conditions of the required second - type data according to the preset operation strategy, and sends it to the ferry folder of the network gateway;

[0044] The ferry folder of the first network scanning network isolation device parses the corresponding operation commands after discovering new files, queries the relevant database of the first network, and sends the query results to the ferry folder of the network isolation device;

[0045] The second network scans the ferry folder of the network isolation device. After discovering the preset range of the second type of data files named with the corresponding operation identification codes, it reads and generates tile data and sends it to the service request.

[0046] As Figure 2 shown, taking the first network as the classified network (i.e., the internal network) and the second network as the unclassified network (i.e., the external network) as an example, the service construction and request of the second type of data in this embodiment are further described. The following steps can be specifically adopted to implement:

[0047] According to the service application requirements, the external network information service module passes the required high-precision data range, scale and other conditions to the external network information generation module to generate an external network information transfer file according to the preset operation strategy. The external network information transmission module sends it to the network isolation device, and the network isolation device ferries it to the internal network;

[0048] The internal network information monitoring and transmission module continuously scans the ferry folder of the network isolation device. After discovering new files, it transfers them to the internal network information parsing module, which translates them into specific operation commands;

[0049] If the operation command belongs to service construction, the internal network service data generation module is called to query the relevant database of the internal network, construct the data entity required for the service, and generate an unclassified logical data set file named with the operation identification code, which is ferried to the external network through the network isolation device. After the external network information monitoring and transmission module scans the ferry folder of the external network and discovers the logical data set file named with the corresponding operation identification code, it uses it to construct a service without an entity;

[0050] If the operation command belongs to service request, the internal network service data generation module is called to query the relevant database of the internal network, dynamically generate the tiles required for the service, construct a small-range unclassified tile data named with the operation identification code, and ferry it to the external network through the network isolation device. After the external network information monitoring and transmission module scans the ferry folder of the external network and discovers the tile file named with the corresponding operation identification code, it sends it to the service request. A cache can be established in this step to improve efficiency, but its range is controlled within 25 square kilometers to meet the confidentiality requirements.

[0051] In summary, the method of this embodiment realizes the separation of data entities and services with the help of logical data sets, and can solve the problem of constructing internal network classified data services on the external network; using limited classified data, it can realize the online application of large-scale classified data on the unclassified network; using ferry file parsing, it can realize online operation of internal network data through the external network across the network isolation device.

[0052] Embodiment 2

[0053] A system for online application of classified surveying and mapping results in a non-classified network, including a first network, a second network, and a network gateway. The first network is connected to the second network through the network gateway;

[0054] The first network is configured to decrypt the data entities required by the second network to obtain the first type of data, and deploy it to the second network. The first type of data includes non-classified surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold;

[0055] The second network is configured to construct a logical data set based on the first type of data and execute services separated from the entities through the logical data set; based on the network gateway and a preset operation strategy, execute the online service of the mixture of the first type of data and the second type of data in the second network. The second type of data includes non-classified surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold within the first network.

[0056] Preferably, the first threshold includes the spatial range limit for the public application of classified surveying and mapping result data; the second threshold includes the precision limit for the public application of classified surveying and mapping result data; the logical data set includes a data condition set that records the data range and precision required for the service, and can realize that one set of data entities supports multiple services, and multiple sets of data entities support one service.

[0057] Preferably, the operation content of the preset operation strategy includes an operation identification code and data conditions; the operation identification code represents the transmission of the operation result, realizes the binding with the operation request corresponding to the second network, and the transmission method includes expressing through the file name; the data conditions represent the content of the data to be queried.

[0058] Preferably, executing the online service of the mixture of the first type of data and the second type of data in the second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than the first threshold and a precision lower than the second threshold, directly read the first type of data in the second network; when the required data is surveying and mapping result data with a range less than the first threshold and a precision higher than the second threshold, read the second type of data in the first network through the network gateway and the preset operation strategy.

[0059] Preferably, realizing the online service of the second type of data in the second network through the network gateway and the preset operation strategy includes:

[0060] The second network generates a second network information transfer file according to the service request with the data conditions of the required second type of data according to the preset operation strategy, and sends it to the transfer folder of the network gateway;

[0061] The first network scans the transfer folder of the network gateway, after discovering a new file, parses the corresponding operation command, queries the relevant database in the first network, and sends the query result to the transfer folder of the network gateway;

[0062] After the ferry folder of the second network scanning network isolation device discovers the second type of data files within the preset range named with the corresponding operation identification code, it reads and generates tile data and sends it to the service request.

[0063] In summary, the method and system for online application of classified surveying and mapping results in a non-classified network of the present invention have the following characteristics:

[0064] 1) Utilize the regulation that the network isolation device is a physical isolation device to achieve online connection between the internal and external networks.

[0065] 2) Through application scenario analysis, obtain the conclusion that the application space range of most classified data is limited, and utilize the regulation that limited classified data can run on the external network to achieve the application of classified data on the external network.

[0066] 3) Propose a preset operation strategy to break through the confidentiality control that the network isolation device can only perform data ferry and does not support the transmission of public protocol information, and achieve online query of internal and external network data and application of limited classified data in compliance with confidentiality regulations.

[0067] 4) Propose an online data service method that combines the external network logical data set and the internal network data entity to achieve the online application of limited classified data.

[0068] It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations. However, those skilled in the art should know that the present application is not limited by the described action sequence, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the present application.

Claims

1. A method for applying confidential surveying and mapping results online on a non-confidential network, characterized in that: include: Declassifying the data entities required by the second network in the first network to obtain the first type of data, and deploying it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; Constructing a logical data set based on the first type of data in the second network, and executing services separated from the entity through the logical data set; executing online services in the second network in which the first type of data and the second type of data are mixed based on the network gate and the preset operation strategy; the second type of data includes non-confidential surveying and mapping results data within the first network with a range smaller than the first threshold and an accuracy higher than the second threshold; The online service of performing a mixture of first-category data and second-category data on a second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, directly reading the first-category data of the second network; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, reading the second-category data in the first network through a network gate and a preset operation strategy.

2. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 1, characterized in that: The first threshold includes the spatial range limit of the public application of confidential surveying and mapping results data; The second threshold includes the accuracy limit of the confidential surveying and mapping results data that can be publicly applied; The logical data set includes a data condition set that records the data range and accuracy required by the service, and can realize that one set of data entities supports multiple services, and multiple sets of data entities support one service.

3. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 1, characterized in that: The operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result, realizes binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

4. The method for applying confidential surveying and mapping results online on a non-confidential network according to claim 1, characterized in that: The online services of the second type of data in the second network are realized through the network gate and preset operation strategies, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

5. A system for applying confidential surveying and mapping results online on a non-confidential network, characterized in that: It includes a first network, a second network and a network gate, wherein the first network and the second network are connected via the network gate; The first network is configured to declassify the data entity required by the second network to obtain the first type of data, and deploy it to the second network; the first type of data includes non-confidential surveying and mapping results data with a range greater than a first threshold and an accuracy lower than a second threshold; The second network is configured to construct a logical data set based on the first type of data, and execute services separated from the entity through the logical data set; based on the network gate and the preset operation strategy, execute online services in which the first type of data and the second type of data are mixed in the second network; the second type of data includes non-confidential surveying and mapping results data within the first network with a range less than a first threshold and an accuracy higher than a second threshold; The online service of performing a mixture of first-category data and second-category data on a second network includes: when the second network receives a service request, when the required data is surveying and mapping result data with a range greater than a first threshold and an accuracy lower than a second threshold, directly reading the first-category data of the second network; when the required data is surveying and mapping result data with a range less than the first threshold and an accuracy higher than the second threshold, reading the second-category data in the first network through a network gate and a preset operation strategy.

6. The system for applying confidential surveying and mapping results online on a non-confidential network according to claim 5, characterized in that: The first threshold includes the spatial range limit of the public application of confidential surveying and mapping results data; The second threshold includes the accuracy limit of the confidential surveying and mapping results data that can be publicly applied; The logical data set includes a data condition set that records the data range and accuracy required by the service, and can realize that one set of data entities supports multiple services, and multiple sets of data entities support one service.

7. The system for applying confidential surveying and mapping results online on a non-confidential network according to claim 5, characterized in that: The operation content of the preset operation strategy includes an operation identification code and a data condition; the operation identification code represents the transmission of the operation result, realizes binding with the operation request corresponding to the second network, and the transmission method includes expression through a file name; the data condition represents the content of the required query data.

8. The system for applying confidential surveying and mapping results online on a non-confidential network according to claim 5, characterized in that: The online services of the second type of data in the second network are realized through the network gate and preset operation strategies, including: The second network generates a second network information transmission file according to the data conditions of the required second type of data according to the preset operation strategy based on the service request, and sends it to the ferry folder of the network gate; The first network scans the ferry folder of the network gate, and after finding a new file, parses the corresponding operation command, queries the first network related database, and sends the query result to the ferry folder of the network gate; The second network scans the ferry folder of the network gate, and after finding the second type of data file in the preset range named corresponding to the operation identification code, reads and generates tile data and sends it to the service request.

Images