Guide to the Whole Process of Tile Encryption |
In order to prevent tile data crawling and further enhance the security of use, SuperMap 11i (2024) series products provide full-process tile encryption capability from server-side encryption to client-side decryption. At the same time, the encryption algorithm also supports the national standard. SM4 state secret algorithm.
This chapter will introduce in detail how to encrypt tile data in SuperMap iServer and how to decrypt and browse tile data in SuperMap Web client to help the safe use of tile data in actual business.
SM4 algorithm, the full name of SM4 block cipher algorithm, is a commercial cryptographic algorithm standard issued by the State Encryption Administration of China. In SuperMap The algorithm is built in iServer, and the mode and key length used when encrypting tile data are defaulted as follows:
AES (Advanced Encryption Standard) algorithm, the most common symmetric encryption algorithm, is a block encryption standard adopted by the Federal Government of the United States. Built in this algorithm in SuperMap iServer, the default mode and key length used for encrypting tile data are as follows:
SuperMap iServer implements tile encryption by dynamically encrypting service interfaces that obtain tiles from different services. Encryption configuration and authentication methods are described below.
The encryption algorithm and specification are configured through the < encryption > node, located in the < security> node of iserver-system.xml ( ( 【SuperMap IServer installation directory】\webapps\iserver\WEB-INF), the specific example is as follows:
<!-- iServer encryption algorithm and specification configuration -->
<encryption class="com.supermap.server.config.EncryptionSetting">
<serviceKeySettings>
<serviceKeySetting>
<keyID>keyID1</keyID>
<version>1.1</version>
<algorithm>SM4</algorithm>
<keyLength>128</keyLength>
</serviceKeySetting>
</serviceKeySettings>
<keyProviderSettings>
<keyProvider>com.supermap.model.util.SM4SecretKeyProvider</keyProvider>
</keyProviderSettings>
</encryption>
Among,
In order to use the expected encryption method for tiles, it is also necessary to dynamically encrypt the GIS services that can obtain this type of tile in the iserver-vcworkkeymappings.xml file (under SuperMap iServer installation directory\webapps\isurver\WEB-INF\config). The following are examples of configuring interfaces for tile encryption in 3D, map, and data services:
<?xml version="1.0" encoding="UTF-8"?>
<svcworkkeymappings>
<!-- Encryption configuration of 3D service components (taking model tiles with a suffix of. s3m as an example)-->
<serviceType>
<typeName>com.supermap.services.components.impl.RealspaceImpl</typeName>
<keyID>keyID1</keyID>
<urls>
<string>/iserver/services/.*?/rest/realspace/datas/.*?/data/path/.*?/.*?\.s3m.*</string>
</urls>
</serviceType>
<!-- Encryption configuration of map service component (taking vector tiles with suffix. mvt as an example)-->
<serviceType>
<typeName>com.supermap.services.components.impl.MapImpl</typeName>
<keyID>keyID2</keyID>
<urls>
<string>/iserver/services/.*?/rest/maps/.*?/tileFeature\.mvt.*</string>
<string>/iserver/services/.*?/restjsr/v1/vectortile/maps/.*?/tiles/.*?/.*?/.*?\.mvt.*</string>
</urls>
</serviceType>
<!-- Encryption configuration of data service components (taking vector tiles with a suffix of. mvt as an example)-->
<serviceType>
<typeName>com.supermap.services.components.impl.DataImpl</typeName>
<keyID>keyID3</keyID>
<urls>
<string>/iserver/services/.*?/rest/data/datasources/.*?/datasets/.*?/tileFeature\.mvt.*</string>
</urls>
</serviceType>
</svcworkkeymappings>
Among,
For example, to the vector tiles service tiles interface (example Url: http://localhost:8090/iserver/services/map-world/restjsr/v1/vectortile/maps/World/tiles/0/0/0.mvt), then < string > node needs to be configured as /iserver/services/.*?/restjsr/v1/vectortile/maps/.*?/tiles/.*?/.*?/.*?\.mvt.*
After completing the above configuration, restart SuperMap iServer and publish services, and the tile encryption configuration will take effect. You can verify this in two ways.
{
...
"serviceEncryptInfo":
{
"encrptSpec":
{
"keyLength":128,
"attributes":null,
"version":"1.1",
"algorithm":"SM4"
}
"updateTime":"Fri Sep 06 10:07:15 CST 2024",
"encrptKeyID":"keyID1"
}
...
"url": "http://localhost:8090/iserver/services/map-China100/restjsr"
}
The tile data encrypted by SuperMap iServer can only be browsed through client decryption. The following will introduce how to load and display encrypted tile data from two aspects: SuperMap 2D client and 3D client.
OpenLayers and MapboxGL are available in SuperMap iClient 11i (2024) API for decrypting and browsing vector tiles data, Please refer to the version of SuperMap iClient the official website help documentation. A brief sample code is provided below to illustrate the specific application:
<script type="text/javascript">
const styleURL =
"http://localhost:8090/iserver/services/map-China100/restjsr/v1/vectortile/maps/China_4326/style.json";
...
style.on('styleloaded', function () {
const vectorLayer = new ol.layer.VectorTile({
declutter: true,
source: new ol.source.VectorTileSuperMapRest({
style: styleURL,
projection: 'EPSG:4326',
format: format,
decrypt: true //Decryption parameters
}),
style: style.getStyleFunction()
});
map.addLayer(vectorLayer);
});
</script>
Add the decryptSources class to the regular code and configure the source value in style, such as China. After the code is executed, the iServer published service can be decrypted and rendered in vector tiles.
<script type="text/javascript">
mapboxgl.supermap.decryptSources.set(["China"]); //Decryption parameters
var map = new mapboxgl.Map({
container: "map",
renderWorldCopies: false,
style: "http://172.16.15.94:8090/iserver/services/map-China100/rest/maps/China/tileFeature/vectorstyles.json?type=MapBox_GL&styleonly=true",
center: [106, 35],
zoom: 4
});
</script>
Support for SuperMap iClient3D for WebGL/WebGPU 11i (2024) SP1 The S3M 3D model tile is decrypted and browsed. There is no need to add more parameters in the code. After SuperMap iServer is introduced to use the 3D service address published by the 3D model tile, the code can be executed for browsing. A brief sample code is provided below to illustrate the specific application:
<script type="text/javascript">
function init(SuperMap3D, scene, viewer) {
...
try{
var promise = scene.open("http://localhost:8090/iserver/services/3D-CBD/rest/realspace");
SuperMap3D.when(promise,function(layers){
var layer = scene.layers.find('Config');
sceneLayer = layer;
},function(){
var title = 'Failed to load SCP, please check the network connection status or if the URL address is correct?';
widget.showErrorPanel(title, undefined, e);
});
}
catch(e){
if (widget._showRenderLoopErrors) {
var title = 'An error occurred during rendering, rendering has been stopped.';
widget.showErrorPanel(title, undefined, e);
}
}
...
}
</script>