Efficient encryption and decryption method for super large remote sensing image data

Abstract

The application discloses an efficient encryption and decryption method for super large remote sensing image data, and relates to the technical field of remote sensing image data encryption. The method comprises the following steps: acquiring each image data block of original remote sensing image data, and determining whether each image data block is a key block; constructing an image pyramid, and calculating the Hilbert coding value of the center point coordinate of each image data block in each layer; encrypting the key block based on an SM4-CTR algorithm; performing lightweight scrambling on the non-key block and the image data block in each layer except the bottom layer; sequentially storing each encrypted block data body in the order of the layer of the image pyramid and the ascending order of the Hilbert coding value in each layer; and finally, constructing a global header index and adding it to the global header index area. The application can realize decryption of only the encrypted block required by the user, and only strong encryption of the key block, thereby reducing the calculation complexity.

Description

Technical Field

[0001] This application relates to the field of remote sensing image data encryption technology, and in particular to an efficient encryption and decryption method for ultra-large remote sensing image data. Background Technology

[0002] In the field of remote sensing image data encryption, traditional methods mainly employ two approaches: file encryption and pixel-value encryption. File encryption methods (such as AES, DES, SM4, etc.) typically encrypt the entire remote sensing image data file. While offering high security, decrypting the entire image file is still required when the user only needs to decrypt a portion of the data, resulting in a large computational load and low efficiency. Pixel-value encryption methods encrypt each pixel value independently. Although this allows for fine-grained decryption, the highly granular encryption necessitates numerous independent decryption operations, also leading to efficiency issues. Summary of the Invention

[0003] The purpose of this application is to provide an efficient encryption and decryption method for ultra-large remote sensing image data, which can decrypt only the encrypted blocks required by the user, avoid unnecessary decryption calculations, and perform strong encryption only on key blocks, thereby reducing computational complexity.

[0004] To achieve the above objectives, this application provides the following solution:

[0005] Firstly, this application provides an efficient encryption method for ultra-large remote sensing image data, including:

[0006] Obtain each image data block from the raw remote sensing image data and determine whether each image data block is a key block;

[0007] Based on each image data block of the original remote sensing image data, an image pyramid is constructed using downsampling operations;

[0008] For each layer of the image pyramid, the Hilbert space-filling curve algorithm is used to calculate the Hilbert-coded value of the center point coordinates of each image data block in the layer;

[0009] For each key block at the bottom layer of the image pyramid, encryption is performed based on the SM4-CTR algorithm to obtain the corresponding encrypted block;

[0010] For each non-critical block at the bottom of the image pyramid, perform lightweight scrambling to obtain the corresponding encrypted block;

[0011] For each image data block in each layer of the image pyramid except the bottom layer, a lightweight scramble is performed to obtain the corresponding encrypted block;

[0012] The encrypted block data bodies are stored sequentially according to the hierarchical order of the image pyramid and the ascending order of the Hilbert code values ​​within each layer; each encrypted block data body includes an encrypted block and a corresponding header marker; the header marker includes an encryption algorithm identifier.

[0013] A global header index is constructed and added to the global header index area; the global header index area is adjacent to the storage area of ​​the first encrypted block data body; the global header index includes metadata of each encrypted block data body arranged in ascending order of the image pyramid hierarchy and the Hilbert code values ​​within each layer; the metadata includes physical storage offset, data length, spatial coordinates and pyramid level ID.

[0014] Secondly, this application provides an efficient decryption method for ultra-large remote sensing image data, including:

[0015] Request to obtain the global header index of the encrypted remote sensing image data; the encrypted remote sensing image data is determined by applying the efficient encryption method for ultra-large remote sensing image data described in the first aspect;

[0016] The Hilbert coding range corresponding to the region to be decrypted is determined based on the spatial range of the region to be decrypted and the image pyramid level ID where the region to be decrypted is located.

[0017] Based on the Hilbert encoding range corresponding to the decryption area, determine the metadata of each encrypted block data body corresponding to the decryption area in the global header index;

[0018] Based on the metadata of each encrypted block data body corresponding to the decryption area, request to obtain each encrypted block data body corresponding to the decryption area.

[0019] For each encrypted block data body corresponding to the decryption area, the encryption algorithm is determined according to the encryption algorithm identifier marked in the header of the encrypted block data body; based on the determined encryption algorithm, the corresponding decryption algorithm is selected to decrypt the encrypted block in the encrypted block data body to obtain the corresponding image data block;

[0020] All the image data blocks obtained from decryption are integrated to obtain the image data corresponding to the area to be decrypted.

[0021] According to the specific embodiments provided in this application, this application has the following technical effects:

[0022] This application provides an efficient encryption and decryption method for ultra-large remote sensing image data. First, it acquires each image data block of the original remote sensing image data and determines whether each image data block is a critical block. Then, based on each image data block of the original remote sensing image data, it constructs an image pyramid using downsampling operations. For each layer of the image pyramid, it uses the Hilbert space-filling curve algorithm to calculate the Hilbert code value of the center point coordinates of each image data block in that layer. For each critical block in the bottom layer, it encrypts using the SM4-CTR algorithm. For each non-critical block in the bottom layer, it performs lightweight scrambling. For each image data block in each layer except the bottom layer, it performs lightweight scrambling. The encrypted block data bodies are stored contiguously according to the hierarchical order of the image pyramid and the ascending order of the Hilbert code values ​​within each layer. Finally, it constructs a global header index and adds it to the global header index area. The global header index includes metadata of each encrypted block data body arranged according to the hierarchical order of the image pyramid and the ascending order of the Hilbert code values ​​within each layer. The above scheme allows users to quickly locate the metadata of the required encrypted block data body based on the spatial location of the image area, and then request the corresponding encrypted block data body based on the located metadata. Furthermore, the scheme divides the image data blocks into critical blocks and non-critical blocks, and only performs strong encryption on the critical blocks, while only performing lightweight scrambling on the non-critical blocks, thereby greatly reducing the amount of decryption computation and improving computational efficiency. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart illustrating an efficient encryption method for ultra-large remote sensing image data provided in an embodiment of this application;

[0025] Figure 2 A flowchart illustrating an efficient decryption method for ultra-large remote sensing image data provided in an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of the main process of block selection encryption technology provided in an embodiment of this application;

[0027] Figure 4 This is a schematic diagram illustrating TIFF format parsing according to an embodiment of this application;

[0028] Figure 5 This is a schematic diagram illustrating the parsing of GEO TIFF format according to an embodiment of this application;

[0029] Figure 6 This is a schematic diagram of an SOAF storage structure provided in an embodiment of this application;

[0030] Figure 7 This is a schematic diagram of the main process of the on-demand decryption technology provided in an embodiment of this application. Detailed Implementation

[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] In one exemplary embodiment, such as Figure 1 As shown, an efficient encryption method for ultra-large remote sensing image data is provided, including the following steps 101 to 108. Wherein:

[0034] Step 101: Obtain each image data block (referred to as block) of the original remote sensing image data, and determine whether each image data block is a key block.

[0035] Step 102: Based on each image data block of the original remote sensing image data, construct an image pyramid using downsampling operations.

[0036] The bottom layer of the image pyramid consists of individual image data blocks from the original remote sensing image data. To facilitate differentiation from image data blocks in other layers, these image data blocks from the original remote sensing image data (i.e., the image data blocks at the bottom layer of the image pyramid) are also referred to as original image data blocks.

[0037] Step 103: For each layer of the image pyramid, use the Hilbert space-filling curve algorithm to calculate the Hilbert encoded value of the center point coordinates of each image data block in the layer.

[0038] Step 104: For each key block at the bottom of the image pyramid, encrypt it based on the SM4-CTR algorithm to obtain the corresponding encrypted block.

[0039] Step 105: Perform lightweight scrambling on each non-critical block at the bottom of the image pyramid to obtain the corresponding encrypted block.

[0040] Step 106: Perform lightweight scrambling on each image data block in each layer of the image pyramid except the bottom layer to obtain the corresponding encrypted block.

[0041] Step 107: Store each encrypted block data body consecutively according to the hierarchical order of the image pyramid and the ascending order of the Hilbert code values ​​within each layer; the encrypted block data body includes the encrypted block and the corresponding header marker; the header marker includes the encryption algorithm identifier.

[0042] Step 108: Construct a global header index and add it to the global header index area; the global header index area is adjacent to the storage area of ​​the first encrypted block data body; the global header index includes metadata of each encrypted block data body arranged in ascending order of the image pyramid hierarchy and the Hilbert code values ​​within each layer; the metadata includes physical storage offset, data length, spatial coordinates and pyramid hierarchy ID.

[0043] As an optional implementation, step 101, determining whether each image data block is a key block, specifically includes:

[0044] Steps 101-11: Perform fast discrete curvelet transform on each image data block of the original remote sensing image data to obtain the curvelet coefficient feature vector corresponding to each image data block; the curvelet coefficient feature vector includes energy intensity, orientation disorder and edge density.

[0045] Steps 101-12: For each image data block of the original remote sensing image data, if the energy intensity, orientation disorder, and edge density in the corresponding curve coefficient feature vector all exceed their respective thresholds, the image data block is determined to be a critical block; otherwise, the image data block is determined to be a non-critical block.

[0046] As an optional implementation, step 104 specifically includes:

[0047] For each key block at the bottom of the image pyramid, the JPEG2000 algorithm is first used for compression, and then the SM4-CTR algorithm is used for encryption to obtain the corresponding encrypted block.

[0048] As an optional implementation, step 105 specifically includes:

[0049] For each non-critical block at the bottom of the image pyramid, the JPEG2000 algorithm is first used for compression, and then lightweight scrambling is performed to obtain the corresponding encrypted block.

[0050] As an optional implementation, step 106 specifically includes:

[0051] For each image data block in each layer of the image pyramid except the bottom layer, the LZW algorithm is first used for compression, and then lightweight scrambling is performed to obtain the corresponding encrypted block.

[0052] As an optional implementation, the original remote sensing image data is in GEO TIFF format.

[0053] As an optional implementation, step 102 specifically includes:

[0054] Steps 102-11: Determine all image data blocks of the original remote sensing image data as the current layer.

[0055] Steps 102-12: Perform downsampling on the image data blocks in the current layer to obtain a new layer.

[0056] Steps 102-13: Determine whether the termination condition has been met. If not, determine the new layer as the current layer and return to the step "Perform downsampling operation on the image data blocks in the current layer to obtain the new layer". The termination condition is that the number of image data blocks in the new layer is 1 or the number of layers in the image pyramid reaches a preset number.

[0057] As an optional implementation, steps 102-12 specifically include:

[0058] Select two adjacent 2x2 image data blocks in the current layer, and resample them using a bilinear interpolation algorithm to generate a new image data block; wherein, the new image data block has the same size as each image data block in the current layer; the relationship between the new image data block and any of the selected 2x2 image data blocks is that of a child and a parent.

[0059] Repeat the above operation until there are no unselected image data blocks in the current layer, and then determine all the new image data blocks as the new layer.

[0060] As an optional implementation, the header marker further includes a parent pointer and a child pointer; the parent pointer points to the encrypted block data body corresponding to the parent image data block; and the child pointer points to the encrypted block data body corresponding to the child image data block.

[0061] In one exemplary embodiment, such as Figure 2 As shown, an efficient decryption method for ultra-large remote sensing image data is provided, including the following steps:

[0062] Step 201: Request the global header index of the encrypted remote sensing image data; the encrypted remote sensing image data is determined by the efficient encryption method for ultra-large remote sensing image data in Example 1.

[0063] Step 202: Determine the Hilbert coding range corresponding to the region to be decrypted based on the spatial range of the region to be decrypted and the image pyramid level ID where the region to be decrypted is located.

[0064] Step 203: Determine the metadata of each encrypted block data body corresponding to the decryption area in the global header index based on the Hilbert encoding range corresponding to the decryption area.

[0065] Step 204: Based on the metadata of each encrypted block data body corresponding to the decryption area, request to obtain each encrypted block data body corresponding to the decryption area.

[0066] Step 205: For each encrypted block data body corresponding to the decryption area, determine the encryption algorithm according to the encryption algorithm identifier in the header of the encrypted block data body; based on the determined encryption algorithm, select the corresponding decryption algorithm to decrypt the encrypted block in the encrypted block data body to obtain the corresponding image data block.

[0067] Step 206: Integrate all the decrypted image data blocks to obtain the image data corresponding to the area to be decrypted.

[0068] To help those skilled in the art further understand the technical solution of this application, further explanation is provided below.

[0069] Current confidentiality protection technologies for ultra-large remote sensing image data generally suffer from three major drawbacks: rigid encryption mechanisms, coarse-grained access, and weak concurrency support. Existing methods mostly adopt a uniform encryption strategy across the entire domain (such as full-map encryption based on AES / SM4), resulting in low decryption efficiency and huge consumption of computing resources. When users only need to access a small range of image data in a specific area, all image data is still forcibly loaded and decrypted, causing serious redundant calculations and waste of I / O bandwidth. It is difficult to meet the application requirements of high concurrency and fine-grained real-time access in the era of big data.

[0070] To address this, this application proposes an adaptive selective encryption / decryption method for random access. Its innovation lies in: firstly, constructing a Streaming-Optimized Access Fabric (SOAF) based on embedded block storage technology, achieving rapid location of block data by index position through spatial block reorganization, Image File Directory (IFD) chain reordering, and pyramid index optimization; secondly, extracting multi-scale texture features based on curve transform, and accurately identifying key blocks containing sensitive areas by combining energy thresholding and morphological analysis; and thirdly, employing a dual-channel encryption engine—strong encryption using the SM4 commercial cryptographic algorithm on key blocks containing sensitive areas, and lightweight pixel value scrambling encryption on non-key blocks; during data distribution and access, only the block subset associated with the target area needs to be decrypted as needed based on the user-defined range request, completely avoiding the decryption processing of ultra-large full-image data. When a user accesses a specific area, the amount of decrypted data is reduced, decryption efficiency is significantly improved, memory consumption is reduced, and real-time streaming access in high-concurrency scenarios can be supported.

[0071] (a) Block-based dual-channel encryption method.

[0072] The process of segmenting and dual-channel encryption of ultra-large remote sensing image data is as follows: Figure 3 As shown.

[0073] (1) Construct a streaming optimized storage structure (SOAF).

[0074] Step 1: For the original georeferenced TIFF image (GEO TIFF format), analyze its internal IFD chain (i.e., the original IFD chain) and perform embedded physical spatial partitioning and discrete curvelet transform; specifically:

[0075] 1) For the original GeoTIFF image data (Data 1), physical space grids are divided according to the preset block size (e.g., 512x512 pixels) to generate a series of physical block sets and corresponding spatial coordinate information.

[0076] It's important to note that in the fields of remote sensing and geographic information, to efficiently process massive amounts of data, the GeoTIFF format for storing ultra-large imagery almost always uses tiled storage rather than stripped storage. A single, untiled TIFF file is impractical for GB / TB-level remote sensing imagery due to extremely low access efficiency. The "raw georeferenced TIFF imagery (GEO TIFF format)" mentioned in this article follows this industry standard by default, meaning it is already a tiled GeoTIFF. Therefore, it inherently contains a raw IFD chain, with entries pointing to the storage locations of the various raw data blocks. Thus, the existing physical tiles of the raw file can be directly utilized, logically defining it as the set of "image data blocks" processed in this article. If the raw file tile size differs from the preset size, resampling and re-division are required.

[0077] For files with built-in chunks, the original IFD chain contains metadata for each chunk, such as chunk size, the starting position of each chunk in the file, and the data length of each chunk. The physical chunk structure of the original file can be used as the foundation for processing. The purpose of "parsing the original IFD chain" is to read this pre-existing chunk metadata from the original file for subsequent operations such as reordering and pyramid construction. In other words, by parsing the IFD chain of the original GeoTIFF file, all chunk metadata (such as TileOffsets and TileByteCounts) is loaded into memory, forming a metadata set that can be quickly queried in subsequent steps.

[0078] 2) For each block in the above physical block set (data 2), perform Fast Discrete Curvature Transform (FDCT) to calculate the curve coefficients of each block at multiple scales and in multiple directions, and generate the curve coefficient feature vector of each block. This vector includes, but is not limited to, core parameters such as energy intensity (E), directional disorder (C), and edge density (D).

[0079] Step 2: Based on the original block data (i.e., the blocks in the physical block set), a multi-level pyramid is generated by downsampling to construct the internal pyramid hierarchy.

[0080] The specific implementation process of step 2 is as follows, aiming to build an embedded pyramid structure that supports fast access across multiple resolutions:

[0081] 1) Define the base layer (L0 layer):

[0082] The embedded physical space block set obtained in step 1 is defined as the 0th level (L0) of the pyramid, which is the original highest resolution layer.

[0083] 2) Generate the upper-level pyramid hierarchy (Ln levels, n≥1):

[0084] For the highest resolution layer that has not been sampled at the next level (e.g., L0 layer), downsampling is performed to generate its next higher pyramid level (e.g., L1 layer). Specifically, pixel data from four adjacent 2x2 blocks (a total of four blocks) are taken and resampled using bilinear interpolation to generate a new block with the original block size (e.g., 512x512 pixels). This new block represents a new dataset with the same geographical area but a resolution reduced to 1 / 4.

[0085] Repeat this process, performing the 2x2 aggregation downsampling on the newly generated level (e.g., L1 level) to generate the next level (L2 level), until a specified number of pyramids (e.g., N levels) are generated or a single block is finally generated.

[0086] Step 3: IFD chain reorganization and spatial index construction; Based on the Hilbert space filling curve algorithm, calculate the Hilbert code value (i.e., spatial key value) corresponding to the coordinates of the center point of each block, and reorder the IFDs of all blocks in ascending order according to this code value to ensure that the physical storage order is consistent with the spatial continuity; store the reordered IFDs contiguously and build a logical IFD index table.

[0087] Step 3 involves reorganizing and optimizing the IFD information of the complete, multi-level block set after Steps 1 and 2 have been completed and a complete set of data blocks for all pyramid levels has been generated.

[0088] Step 4: Store the block pixel data consecutively in the order of the IFD reorganized in Step 3, and add a global header index (i.e., file header information) and a header tag for each block.

[0089] Before encryption, the system needs to determine the final layout of the entire file. That is, all data blocks (including blocks at each level of the pyramid) are arranged according to the new IFD order, their positions in the file are determined, and the space required for each position is calculated.

[0090] In step 4, the unencrypted raw data (or compressed but unencrypted data) is written according to this layout. The purpose is:

[0091] (1) Determine the exact offset and length: Only after writing the data can we know the exact starting position (Offset) and size (Length) of each "encrypted block data body" in the file. This information needs to be recorded in the "global header index".

[0092] (2) Reserve header space: Reserve space for the “header mark” of each block and fill it with the information known at this time (such as parent / child pointers).

[0093] In subsequent steps (steps 5 and 8), the system compresses and encrypts the written data. After encryption, since SM4-CTR is a stream cipher, the ciphertext length remains unchanged, thus not disrupting the pre-defined layout. Finally, in step 9, the system returns to the header of each block and updates and fills it with encryption-related information (such as the encryption algorithm identifier, IV, etc.).

[0094] In the SOAF structure, there are two different levels and functions of metadata storage areas, with clearly defined roles:

[0095] Global Header Index: Located at the beginning of the entire file.

[0096] Per-Tile Header: Located at the very beginning of each per-tile data body, there is one for each per-tile. Per-Tile Header is also called header mark.

[0097] Step 4 involves both of these operations, but they store completely different contents.

[0098] 1) Data writing: The processed block pixel data is continuously written to the data area of ​​the file in the logical order after recombination.

[0099] 2) Populate the global index: In the global index table at the beginning of the file, record the physical storage offset and data length of each block in the file at this time. The metadata of each block also includes: spatial coordinates, pyramid level ID, curve feature vector, and other metadata used for querying and positioning.

[0100] 3) Segmented head structure:

[0101] Storage content: Stores the operation information and relationship information of this block.

[0102] The operation information includes the encryption algorithm identifier, IV / seed, and checksum; since the underlying data (i.e., blocks) has not yet been encrypted, the position is reserved to facilitate the filling of information after encryption.

[0103] Relationship information, including parent pointers, child pointer lists, etc., is used for pyramid navigation.

[0104] The following explains the relationship between the original IFD chain, the logical IFD index table, and the global header index:

[0105] The original IFD chain serves as the input to the scheme. It is the old (existing) index structure to be modified.

[0106] The logical IFD index table is an intermediate product of the scheme. It is a complete copy of the original IFD chain in memory, but reordered. It can be thought of as a "working draft" for generating new indexes.

[0107] The global header index is the output of the solution. It is the essence extracted from the "working draft" and is the efficient index for the final write to the file. It replaces the function of the original IFD chain and has been greatly optimized.

[0108] Step 5: For all upper layers of the pyramid except the bottom layer (low resolution), use LZW lossless compression and perform lightweight scrambling; for the bottom layer (high resolution), use JPEG2000 lossless compression to preserve the original spatial topology.

[0109] Step 6: Metadata hardening and encapsulation, such as the number of storage pyramid levels, block size, spatial reference coordinate system, etc.

[0110] Hardening and encapsulation refer to calculating a checksum or digital signature for critical metadata (global header index) to ensure it is not tampered with during transmission or storage. This step can be considered the final preparatory step in building the SOAF file format. After encapsulation is completed, the file's metadata is completely fixed.

[0111] Sensitive area key block screening:

[0112] Step 7: Generate a parameter set from the feature vectors obtained by Fast Discrete Curvelet Transforms (FDCT) in Step 1; perform threshold judgment on the core parameters (energy intensity, orientation disorder, edge density), and define the data blocks that meet the conditions as sensitive critical blocks, and define other blocks as non-critical blocks, also known as ordinary blocks.

[0113] Dual-channel encryption:

[0114] Step 8: Perform strong encryption on the key block obtained in Step 7 using the SM4-CTR national cryptographic algorithm; perform lightweight pixel value scrambling on the ordinary block.

[0115] Step 9: Return to the header information updated in Step 4, including encryption type flag, encryption timestamp, checksum, etc.

[0116] Further, in steps 1-6: construct the streaming optimized storage structure (SOAF).

[0117] The Streaming Optimized Storage Architecture (SOAF) proposed in this application is a structural innovation addressing the shortcomings of traditional TIFF storage. Its core lies in transforming remote sensing imagery from a sequentially dependent chained storage to a spatially addressable streaming storage through physical storage topology reorganization and access logic reconstruction. The following is a detailed explanation of the principles:

[0118] Traditional TIFF (Tagged Image File Format) is a flexible raster image format, such as... Figure 4 As shown, its core structure includes:

[0119] File header: contains byte order identifier and the offset of the first IFD.

[0120] Image File Directory (IFD): A dictionary structure composed of tags that stores metadata such as image width, height, number of bands, and spatial reference (e.g., ModelPixelScaleTag defines the resolution).

[0121] Pixel data area: Stores raw pixel values ​​in band order or interleaved manner, and supports lossless compression (such as LZW, DEFLATE, etc.).

[0122] As you can see, the entire TIFF file records image data in blocks. All information is linked together by offset values.

[0123] Because of its tag-based format, TIFF is highly extensible and makes adding geographic information to images very convenient. Therefore, GeoTIFF adds a series of (geographic information-related) extended tags to the TIFF tag specification to record the geographic coordinate information of an image, such as... Figure 5 As shown.

[0124] When TIFF processes GB-level remote sensing imagery (such as Sentinel-1 GRD data), its shortcomings become apparent:

[0125] 1) Linear reading is inefficient: Data must be obtained by sequential scanning (e.g., to read 512×512 pixels, the entire file must be downloaded).

[0126] 2) No built-in pyramid: Zooming requires real-time resampling, which consumes computing resources.

[0127] 3) Block storage is not supported: partial access is not possible, and even viewing a thumbnail of a 4GB file requires a full download.

[0128] 4) Poor cloud environment compatibility: Cloud storage is billed based on the number of requests, and inefficient access increases costs.

[0129] For example, when publishing a 30GB Landsat image on GeoServer, TIFF loading caused a memory overflow, requiring it to be cut into 256x256 tiles and pre-generated into a pyramid, which took 6 hours.

[0130] In summary, addressing the inherent limitations of traditional TIFF / GeoTIFF formats when processing large-scale remote sensing imagery—particularly the three core bottlenecks of inefficient linear readout, lack of pyramid structure, and insufficient adaptation to cloud environments—this application proposes a Streaming Optimized Storage Architecture (SOAF) that represents a technological breakthrough. (See [link to relevant documentation]). Figure 6 SOAF storage architecture transforms images from discrete chained storage to spatially addressable continuous streaming storage by deeply reconstructing the data storage paradigm. Its technological advancement is reflected in three dimensions: intelligent reorganization of physical storage topology, dynamic optimization of multi-scale access, and deep adaptation to cloud-native architecture.

[0131] 1) At the storage architecture level, SOAF innovatively introduces an embedded spatial block reorganization mechanism. Unlike traditional TIFF, which relies on offset-based chaining of discrete data blocks, this structure, based on the spatial proximity of geographic coordinates (such as the continuity of longitude and latitude), uses the Hilbert spatial filling curve to physically rearrange the storage order of blocks and embeds block metadata (including size, spatial boundaries, and encryption tags) into the file header index area, ensuring that the physical storage location strictly corresponds to the geographic spatial distribution. Storage according to the spatial key value sorting order enables optimization of the physical layout of data. When a user requests a specific geographic area, the system can directly parse the block parameter table embedded in the header using the spatial key value to locate the target block cluster stored contiguously, transforming the scattered random reads in traditional solutions into efficient aggregated access and completely eliminating the redundant operation of "local access requiring global loading".

[0132] 2) Multi-scale access optimization achieves technological innovation through an embedded pyramid. SOAF automatically generates a hierarchical resolution sequence during the build phase (L0 for the original resolution, L1 for 1 / 4 resolution, etc.) and embeds pointer indices between levels: the upper-level block accurately records the physical offset of the lower-level block, and the lower-level block is linked back to the upper-level block. When the user zooms the view, the system dynamically calculates the optimal matching level and achieves zero-copy data jumps through the pointer chain (for example, when zooming from L2 to L1, the data area pointed to by the parent block pointer is directly read without resampling). This design reduces resolution switching latency compared to traditional solutions and lowers CPU resource consumption, making real-time interactive browsing of images with hundreds of millions of pixels possible.

[0133] Pointer indexes are not stored in a "tag directory (IFD)" similar to traditional TIFF. The SOAF structure completely abandons the centralized tag directory paradigm of traditional TIFF and adopts a distributed, embedded metadata management strategy. These hierarchical pointer indexes are directly embedded in the metadata header of each chunk itself.

[0134] In the SOAF structure, each block (regardless of which level of the pyramid it belongs to) is a self-contained entity, and its storage structure can be abstracted as follows: [block private metadata header] + [block pixel data].

[0135] The pointer index is stored in the [block private metadata header] of each block. This private metadata header is the "header tag" added to each block in step 4.

[0136] When a user zooms in on the map, the system needs to load tiles at another level. Traditional solutions require re-parsing the central IFD to locate the new tile. However, in SOAF, the tile metadata header currently held by the system already contains direct pointers to its parent / child tiles. Therefore, to load a parent or child tile, no calculation or lookup is needed; the system can directly jump to the corresponding location in the file based on the pointer and read the data, achieving the "zero-copy data jump" mentioned in the text.

[0137] Figure 6 The “image data” in the document does not actually contain any data. It acts as a dividing line, with the part before this point being the file header and the part after this point being the encrypted data, i.e., the various encrypted block data bodies.

[0138] Figure 6 In Chinese, such as "abbreviation" Figure 1 "Tile 1", "Tile 2", etc., are all encrypted data. "Tile 1", "Tile 2", etc., refer to the encrypted block data body corresponding to each image data block; "abbreviation" Figure 1 “abbreviation” Figure 2 "etc." refers to the encrypted block data of each level of the pyramid, except for the bottom level.

[0139] 3) Facing the massive concurrency challenges of cloud environments, SOAF's metadata-data separation architecture and adaptive block header demonstrate superior I / O optimization performance. More importantly, blocks can be aligned to 4KB boundaries, perfectly matching the physical page size of SSDs and the smallest computational unit of cloud object storage. This allows the storage system to directly parse the target block content without having to backtrack to the global metadata table. Combined with the block alignment strategy based on storage hardware page size, this not only maximizes I / O efficiency but also naturally adapts to the on-demand computing model of cloud storage, significantly reducing the cost overhead caused by invalid data transfer.

[0140] More importantly, SOAF's architecture design transforms human spatial cognitive logic (such as "adjacent geographical locations are related to data" and "macro to micro hierarchical progression") into a machine-executable storage topology. This consistency between spatial logic and physical layout provides native support for scenarios such as real-time streaming distribution of remote sensing images and regional on-demand decryption, laying a systematic innovation foundation from storage efficiency to security control.

[0141] Further, in step 1: curve wave analysis.

[0142] 1) Definition and core role of curve wave analysis.

[0143] The Curvelet Transform is an advanced multi-scale geometric analysis method that utilizes a dual mechanism of multi-scale frequency domain annular partitioning and multi-directional angular sector decomposition to specifically capture curved edges and directional textures in images. Compared to traditional methods (see Table 1), its anisotropic wedge basis functions have a significant advantage in representing curved structures: Fourier Transform cannot locate spatial positions due to its global frequency domain characteristics; wavelet Transform is limited by 3-directional decomposition and can only identify stepped edges; while the Curvelet Transform's efficiency in capturing curved edges in 16+ directions makes it the optimal solution for extracting artificial structures.

[0144] Table 1 Comparison of Curvilinear Transform and Classical Transform

[0145]

[0146] 2) Irreplaceability in this method.

[0147] Urban areas, characterized by long-range curved road networks and dense, multi-directional building edges, exhibit physical properties highly consistent with curvelet basis functions. As shown in Table 2, urban roads show energy concentration in specific directions at the mesoscale, while wavelet transform energy distribution is dispersed across multiple scales. Natural scenes such as farmland and forests, due to their texture randomness, display either low-energy uniform distribution or high-frequency random dispersion. Field measurements at ICCV 2019 verified that curvelet transform's response sensitivity to man-made curved structures is 3-5 times higher than that of wavelets. This characteristic fundamentally solves the problem of misjudging urban features using traditional methods.

[0148] Table 2 shows the advantages of curved waves in this method.

[0149]

[0150] In summary, the spatial structure of urban areas requires analytical methods with strong directional sensitivity (>16 directions), accurate curve capture capability (non-piecewise approximation), and multi-scale separation characteristics. Traditional transforms, due to their inherent mathematical limitations (see Table 1), cannot meet these requirements: the Fourier transform has a detection rate of only 12% for urban areas, and the Haar wavelet's weak response to oblique edges leads to a false detection rate of 29% for farmland. The wedge-shaped basis functions of the curvelet transform are highly compatible with the geometric characteristics of building outlines, making it the most feasible solution for sensitive area identification in this system. Therefore, the curvelet transform is adopted in this method.

[0151] 3) Key parameters output by curve wave analysis.

[0152] The system extracts three-dimensional quantization parameters through curvelet transform (as shown in Table 3):

[0153] Energy intensity (E): Characterizes the saliency of texture; town blocks are typically located in the top 15 percentile of energy across the entire map.

[0154] Directional disorder (C): defined as the standard deviation of energy in each direction, reflecting the complexity of edge orientation. In urban areas, due to the intertwined road network, it generally exceeds the median by 1.8 times.

[0155] Edge density (D): Calculated as the percentage of pixels at significant edges, with an empirical threshold >0.25.

[0156] The three-parameter joint decision-making can accurately distinguish between similar scenarios such as densely populated industrial areas (E=0.95, C=0.82, D=0.41) and wind farms (E=0.91, C=0.28, D=0.38).

[0157] Table 3 Core Parameters

[0158]

[0159] In summary, curve wave analysis is the core decision-making mechanism of this method's differentiated encryption engine. Multi-scale texture quantization precisely identifies sensitive blocks, driving strong SM4-CTR encryption; over 95% of natural background is efficiently filtered, authorizing lightweight perturbation of ordinary blocks; and a parameterized identification mechanism directly addresses the resource waste problem of full-domain encryption, supporting fine-grained on-demand decryption. This design achieves a balance between security and processing efficiency, providing key technical guarantees for high-concurrency streaming access.

[0160] Further, in step 7: key block screening.

[0161] 1) The necessity of technical encryption for different and differentiated remote sensing images.

[0162] Significant differences exist in the information richness within the same region: urban areas, containing high-value spatial topological information such as road networks, building outlines, and infrastructure, have a data density 5-8 times higher than natural areas (such as forests and water bodies) (as measured in the ISPRS2021 dataset). A uniform encryption strategy across the entire region forces the system to consume equivalent encryption resources for low-value background areas, severely violating the economic principle of information security. This application achieves a precise match between encryption strength and information value by dividing the system into critical blocks and ordinary blocks.

[0163] Key blocks: These contain sensitive semantic information (such as military facilities and urban layouts) and require strong encryption to ensure resistance to attacks.

[0164] Normal blocks: Contain only low-risk natural textures; lightweight perturbation is sufficient to meet privacy protection needs.

[0165] 2) Urban areas serve as the core basis for key blocks.

[0166] The fundamental reason why towns are defined as key blocks lies in their triple information-rich characteristics:

[0167] Spatial inversion risk: Elements such as road intersections and building outlines can be used to inversely deduce geographic coordinates (1:500 accuracy), posing a security threat.

[0168] Semantic sensitivity: Facilities such as industrial parks and ports contain sensitive information, and leakage may lead to significant losses.

[0169] Structural uniqueness: Curve analysis proves that urban blocks have the highest edge density (D>0.25) and directional disorder (C>1.8×median) in the entire graph, making them the primary target for data mining.

[0170] This design is essentially an engineering practice of the principles of information economics in the security field: using the curve parameter as a metric, limited security resources are precisely allocated to the key blocks with the highest information enrichment, thereby achieving a balance between confidentiality requirements and industrial application efficiency.

[0171] Furthermore, in step 8: dual-channel encryption.

[0172] 1) Critical blocks are densely packed.

[0173] In this application, the SM4-CTR algorithm was chosen to encrypt key blocks based on its high security, data structure, computational efficiency, and standardized certification. The SM4-CTR algorithm effectively protects the core content of the data while ensuring that the output ciphertext maintains the exact same byte length as the original plaintext, facilitating format compatibility and subsequent data processing. By using the SM4-CTR algorithm for encryption, this method achieves efficient selective encryption while preserving the same byte length as the plaintext data, providing an innovative solution for selective encryption of ultra-large remote sensing image data.

[0174] 2) Ordinary block pixel perturbation.

[0175] In the security processing scheme for ultra-large remote sensing images, the core purpose of implementing reversible perturbation on non-critical ordinary blocks is to significantly optimize system performance and achieve security obfuscation while ensuring basic data security.

[0176] (ii) Decryption process.

[0177] An example of an on-demand decryption process, such as Figure 7 As shown.

[0178] Step 1: Based on user requirements, request the area that needs to be decrypted;

[0179] User input: The user specifies a geographic area (such as a rectangle) and the desired pyramid hierarchy.

[0180] System actions:

[0181] 1) The system calculates the spatial key value (Hilbert encoding) range or row and column numbers of all involved data blocks based on the requested region and level.

[0182] 2) The system loads and parses the "global header index".

[0183] 3) In the global header index, use fast queries (such as binary search) to find the metadata corresponding to all matching data blocks. This metadata includes the physical storage offset, data length, and encryption algorithm identifier for each data block.

[0184] Step 2: Extract the metadata and ciphertext information of the blocks based on the block index.

[0185] Step 3: Identify the encryption information of each block based on the metadata.

[0186] Step 4: Select the corresponding channel to decrypt the encrypted information.

[0187] Step 5: Integrate the decrypted data to obtain the decrypted data required by the user.

[0188] Furthermore, in steps 1-2: the detailed process of decryption on demand.

[0189] Reading a specific image tile from SOAF requires executing a standardized HTTP request sequence. First, a metadata location request is initiated: the file header data is obtained via `Range: bytes=0-4096`. This operation leverages SOAF's inverted IFD chain feature to ensure that the initial 4KB response contains a complete tile index table. Parsing this index table yields the physical storage parameters of the target tile, such as the offset of the tile in row 5, column 3 (offset=2654208 bytes) and its length (length=24576 bytes). Then, a precise range request is initiated: a request header conforming to the HTTP byte range specification (RFC 7233) is constructed with `Range: bytes=2654208-2678783` (calculated as: end position = offset + length - 1). This request will precisely return 24KB of compressed data for the target tile. The entire process requires only two HTTP interactions (the initial 4KB metadata request + the 24KB data request), and can be completed within 300 milliseconds on a 100Mbps network, representing a 50-fold efficiency improvement compared to the traditional full-file download mode of TIFF.

[0190] This process relies on the pre-built spatial indexing mechanism of the SOAF storage structure: the TileOffsets array, permanently stored in the file header, establishes a direct mapping from tile grid coordinates to the file's physical location, forming a key-value pair structure of <row, column> → <offset, length>. After obtaining the global index table through a lightweight initial request, the client can independently locate any tile data block. This design transforms geospatial queries into standard byte-range requests, enabling single files to have database-like random access capabilities, while fully complying with HTTP protocol specifications and requiring no customized server support.

[0191] Furthermore, in step 4: the efficiency of block decryption.

[0192] Block decryption has demonstrated significant efficiency and flexibility in the decryption of ultra-large remote sensing images, becoming a key strategy for processing large-scale data and meeting users' on-demand decryption needs. Its core advantage lies in dividing the image into multiple independent blocks, each of which can be decrypted independently. This "divide and conquer" strategy not only greatly improves decryption efficiency but also makes full use of computing resources, especially when processing large-scale data. Specifically, block decryption allows the decryption operation of each block to be performed in parallel, thereby significantly reducing the amount of data decrypted per operation, lowering computational complexity, and optimizing resource utilization.

[0193] Furthermore, block decryption supports on-demand decryption, allowing users to request decryption of specific areas or blocks based on their actual needs, without having to download and decrypt the entire dataset. This on-demand decryption strategy not only reduces decryption time and computational resource consumption but also significantly improves system flexibility and user experience. For example, in urban planning, planners may only need to analyze topographic data for a specific area, without needing to decrypt the geographic data of the entire city. Through block decryption, planners can quickly obtain the data for the required area without waiting for the entire dataset to be decrypted. This not only saves time but also reduces the consumption of computational resources, making planning work more efficient. Similarly, in environmental monitoring, researchers may only need to analyze pollution data for a specific area. Through block decryption, researchers can quickly decrypt and obtain the pollution data for that area, enabling timely environmental assessments and decision support.

[0194] Block decryption, with its high efficiency and support for on-demand decryption, provides powerful optimization capabilities for ultra-large image data decryption technology, enabling it to demonstrate significant advantages in large-scale data processing and real-time applications, and providing users with more efficient, flexible and secure decryption services.

[0195] The technical solution of this application has the following beneficial effects:

[0196] (1) This method is more secure and effective than traditional methods in terms of image data encryption.

[0197] Traditional image data encryption methods typically employ an overall encryption strategy or simple physical block encryption. While simple to operate, these methods neglect the sheer volume of data in ultra-large remote sensing images, resulting in low decryption efficiency and enormous computational resource consumption. When users only need to access data in a specific area, all image data is still forcibly loaded and decrypted, causing serious redundant computation and wasted I / O bandwidth. This makes it difficult to meet the application requirements of high concurrency and fine-grained real-time access in the era of big data.

[0198] In contrast, the adaptive selective encryption / decryption method based on the Streaming Optimized Storage Structure (SOAF) proposed in this application has significant advantages: First, by constructing a streaming optimized storage structure strategy, physical region partitioning is performed while ensuring data format compatibility; second, multi-scale texture features are extracted based on curve transform, and key blocks of sensitive areas are accurately identified by combining energy thresholds; furthermore, a dual-channel encryption engine is adopted—strong encryption of key blocks using the SM4-CTR national cryptographic algorithm is performed, while lightweight pixel value perturbation is implemented for non-key ordinary blocks. Because this method performs block-based dual-track encryption on the data, it can effectively resist various known attack methods, including statistical analysis attacks and differential attacks, providing reliable security for the storage and transmission of remote sensing image data. By introducing dual-channel encryption engine technology, the algorithm's anti-attack capability is further enhanced, making the encrypted data more obfuscated and unpredictable. In addition, the embedded block storage technology enables individual files to have complete spatial indexing capabilities, eliminating the dependence on external index files in traditional schemes, improving data portability and cloud distribution efficiency.

[0199] (2) This method is more efficient than traditional image encryption schemes when the user decrypts a small amount of data.

[0200] In the field of remote sensing image data encryption, traditional methods mainly employ two approaches: file encryption and pixel-value encryption. File encryption methods (such as AES, DES, SM4, etc.) typically encrypt the entire remote sensing image data file. While offering high security, decrypting the entire image file is still required when the user only needs to decrypt a portion of the data, resulting in a large computational load and low efficiency. Pixel-value encryption methods encrypt each pixel value independently. Although this allows for fine-grained decryption, the highly granular encryption necessitates numerous independent decryption operations, also leading to efficiency issues.

[0201] In contrast, the block-based selective encryption algorithm proposed in this application has significant advantages when users decrypt smaller amounts of data. First, by embedding block storage technology, IFD chain reordering, and pyramid index optimization, it achieves rapid location of block data based on physical location, constructing a streaming optimized storage structure (SOAF) oriented towards random access. Users only need to decrypt the block containing the required data, avoiding unnecessary decryption calculations. Second, the algorithm only encrypts key blocks; decryption only requires decryption operations on key blocks, while ordinary blocks undergo descrambling decryption, greatly reducing computational complexity. Furthermore, because the algorithm retains the characteristics of the streaming optimized storage structure (SOAF), spatial analysis and visualization operations can be performed directly after decryption, while traditional block-based methods often require additional image block reconstruction steps, further reducing overall efficiency.

[0202] This efficiency advantage is particularly evident in scenarios with limited computing resources, such as mobile and web applications. For example, in cloud platform applications, users often only need to download and decrypt data for a local area; this method can significantly reduce the computational load and improve the user experience. At the same time, the algorithm's efficiency also provides better support for applications with high real-time requirements (such as online map editing and geographic data interaction).

[0203] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0204] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A highly efficient encryption method for ultra-large remote sensing image data, characterized in that, include: Obtain each image data block from the raw remote sensing image data and determine whether each image data block is a key block; Based on each image data block of the original remote sensing image data, an image pyramid is constructed using downsampling operations; For each layer of the image pyramid, the Hilbert space-filling curve algorithm is used to calculate the Hilbert-coded value of the center point coordinates of each image data block in the layer; For each key block at the bottom of the image pyramid, encryption is performed based on the SM4-CTR algorithm to obtain the corresponding encrypted block; For each non-critical block at the bottom of the image pyramid, perform lightweight scrambling to obtain the corresponding encrypted block; For each image data block in each layer of the image pyramid except the bottom layer, a lightweight scramble is performed to obtain the corresponding encrypted block; The encrypted block data bodies are stored sequentially according to the hierarchical order of the image pyramid and the ascending order of the Hilbert code values ​​within each layer; each encrypted block data body includes an encrypted block and a corresponding header marker; the header marker includes an encryption algorithm identifier. A global header index is constructed and added to the global header index area; the global header index area is adjacent to the storage area of ​​the first encrypted block data body; the global header index includes metadata of each encrypted block data body arranged in ascending order of the image pyramid hierarchy and the Hilbert code values ​​within each layer; the metadata includes physical storage offset, data length, spatial coordinates and pyramid level ID.

2. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, Determining whether each image data block is a critical block specifically includes: Fast discrete curvelet transform is performed on each image data block of the original remote sensing image data to obtain the curvelet coefficient feature vector corresponding to each image data block; the curvelet coefficient feature vector includes energy intensity, orientation disorder and edge density. For each image data block in the original remote sensing image data, if the energy intensity, orientation disorder, and edge density in the corresponding curve coefficient feature vector all exceed their respective thresholds, the image data block is determined to be a critical block; otherwise, the image data block is determined to be a non-critical block.

3. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, For each key block at the bottom layer of the image pyramid, encryption is performed based on the SM4-CTR algorithm to obtain the corresponding encrypted block, which specifically includes: For each key block at the bottom of the image pyramid, the JPEG2000 algorithm is first used for compression, and then the SM4-CTR algorithm is used for encryption to obtain the corresponding encrypted block.

4. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, For each non-critical block at the bottom layer of the image pyramid, a lightweight scramble is performed to obtain the corresponding encrypted block, specifically including: For each non-critical block at the bottom of the image pyramid, the JPEG2000 algorithm is first used for compression, and then lightweight scrambling is performed to obtain the corresponding encrypted block.

5. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, For each image data block in each layer of the image pyramid (excluding the bottom layer), a lightweight scrambling process is performed to obtain the corresponding encrypted block, specifically including: For each image data block in each layer of the image pyramid except the bottom layer, the LZW algorithm is first used for compression, and then lightweight scrambling is performed to obtain the corresponding encrypted block.

6. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, The original remote sensing image data is in GEO TIFF format.

7. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, Based on the individual image data blocks of the original remote sensing image data, an image pyramid is constructed using downsampling operations, specifically including: Define all image data blocks of the original remote sensing image data as the current layer; Perform downsampling on the image data blocks in the current layer to obtain a new layer; Determine whether the termination condition has been met. If not, determine the new layer as the current layer and return to the step "perform downsampling operation on the image data blocks in the current layer to obtain the new layer". The termination condition is that the number of image data blocks in the new layer is 1 or the number of layers in the image pyramid reaches a preset number.

8. The efficient encryption method for ultra-large remote sensing image data according to claim 7, characterized in that, The image data blocks in the current layer are downsampled to obtain a new layer, specifically including: Select two adjacent 2x2 image data blocks in the current layer, and resample them using a bilinear interpolation algorithm to generate a new image data block; wherein, the new image data block has the same size as each image data block in the current layer; the relationship between the new image data block and any of the selected 2x2 image data blocks is that of a child and a parent; Repeat the above operation until there are no unselected image data blocks in the current layer, and then determine all the new image data blocks as the new layer.

9. The efficient encryption method for ultra-large remote sensing image data according to claim 1, characterized in that, The header marker also includes a parent pointer and a child pointer; the parent pointer points to the encrypted block data body corresponding to the parent image data block; the child pointer points to the encrypted block data body corresponding to the child image data block.

10. A highly efficient decryption method for ultra-large remote sensing image data, characterized in that, include: Request to obtain the global header index of encrypted remote sensing image data; the encrypted remote sensing image data is determined by applying the efficient encryption method for ultra-large remote sensing image data as described in any one of claims 1-9; The Hilbert coding range corresponding to the region to be decrypted is determined based on the spatial range of the region to be decrypted and the image pyramid level ID where the region to be decrypted is located. Based on the Hilbert encoding range corresponding to the decryption area, determine the metadata of each encrypted block data body corresponding to the decryption area in the global header index; Based on the metadata of each encrypted block data body corresponding to the decryption area, request to obtain each encrypted block data body corresponding to the decryption area. For each encrypted block data body corresponding to the decryption area, the encryption algorithm is determined according to the encryption algorithm identifier marked in the header of the encrypted block data body; based on the determined encryption algorithm, the corresponding decryption algorithm is selected to decrypt the encrypted block in the encrypted block data body to obtain the corresponding image data block; All the image data blocks obtained from decryption are integrated to obtain the image data corresponding to the area to be decrypted.

Images