ISBN 978-952-5726-00-8 (Print), 978-952-5726-01-5 (CD-ROM)

Proceedings of the 2009 International Symposium on Web Information Systems and Applications (WISA09)
Nanchang, P. R. China, May 22-24, 2009, pp. 190-193

Data Security Analysis of WebGIS Based on

Tile-Map Technique
Li Haiting1,2, Peng Qingshan2, Li Yanhong1
1

School of Resource and Environmental Science, Wuhan University, Wuhan, China

2
Wuhan Geotechnical Engineering and Surveying Institute, Wuhan, China
Email:haiting_cn@163.com, wkypeng@126.com, yanhongli1979@163.com

AbstractWith the increasing popularity of global on-line

mapping web applications (e.g. Google Maps, Microsoft
Virtual Earth, Yahoo Maps), Tile-Map technique is widely
used. Map tiles are a set of map images that have been pregenerated based on geographic vector data and the adoption
of tile-map technique in the developed system dramatically
decreases the loading time consumed for high quality image
visualizations. With this technique, the geographic data
(including raster data, vector data and attribute data) of
WebGIS face great potential security challenge. This paper
analyzed the publishing mode based on Tile-Map technique
and discussed the security technology which need adopt,
such as information hiding, digital watermarking, vector
data encryption and restrictive rule of attribute data request.
This paper also analyzed the disastrous result that the
security leak may bring. From the different aspects, this
paper gives the suggestions of the corresponding security
mechanism. In particular, this paper gives the
implementation to encrypt the http request URL and vector
data using relatively simple JavaScript program language.
Finally, this paper emphasizes the importance of improving
the data security based on Tile-Map technique for the
second time.
Index TermsTile-Map, WebGIS, security mechanism, tile
caches, encode algorithm, digital watermarking

I. INTRODUCTION
In recent years, most of WebGIS services publish maps
on internet based on Tile-Map technique, such as Google
Maps, Yahoo Maps, NASAs World Wind, Mapabc,
MapBar, etc. With this technique, the performance had
been improved when the users zoom or scroll the map. In
essence, the tile caches are pre-rendered and pregenerated [1] by special program based on geographic
vector data. As this technique progresses and becomes
more readily available to the wide masses around the
world, the interrelated issues of GIS and map data
security start to surface. This paper analyzed the
publishing mode based on Tile-Map technique and
discussed the security mechanism from four aspects:
client code, raster data, vector data, and attribute data.
This paper also gives the corresponding implementation
to improve the data security based on Tile-Map technique.

Figure 1. Pyramid levels[4]

II. TILE-MAP TECHNIQUE

The publishing way of traditional WebGIS includes
raster-map mode and vector-map mode. Recently, with
the increasing popularity of global on-line web mapping
applications, the raster Tile-Map mode replaces vectormap gradually. A tile caches service has a set of map
2009 ACADEMY PUBLISHER
AP-PROC-CS-09CN001

images that have been pre-rendered for rapid display [2].

Tile caches are those map images that have been pregenerated based on geographic vector data. Before the
tiles were generated, the vector map would be rendered,
and the whole map would be further split with special
algorithm. All the tiles are in fixed size and file format
(e.g. png, gif etc) and these rectangular tiles called map
tiles or tile caches. The tile caches named with different
rows and columns in the same zoom level according to
their own special location. With different hierarchies, tile
caches form a similar T-Pyramid structure (Figure1).
Tiles in an index are stored using this structure to allow
fast access and scroll operations. Some researchers
presented quad tree structure to index the tiles on the
caches server [3]. Tile-Map technique belongs to a richclient structure. When the users exploring the map, the
browser will dynamically download the map tiles and
stitch them up in client side. In order to figure out which
tile to retrieve, the browser needs to send the parameters
about the row, column, zoom level and map type. The tile
caches named with different rows and columns in the
same zoom level according to their own special location
on caches server. Usually, all the tiles are in a unified
Projection, such as Gauss, Mercato, etc. When the
projection and coordinates system are set, it is easy to deal
with the relation of the geometric objects, such as
computing the real distance between two points in any
metric units.

A. The publishing ways Based on Tile-Map Technique

Tile-Map technique has two main publishing ways:
Ajax map [5] and Flex map [6]. Ajax is a new technology
based on asynchronous communication between a client
190

experiments proved that the parameters are regular and

all the map tiles of these websites could be downloaded
though requesting the URL continuously.

web browser and a back-end server, allowing web

applications to request and receive data without ever
reloading the page. A popular application that uses Ajax
technology is Google Maps. Flex Projector is a free, opensource, and cross-platform software application that
allows cartographers to interactively design custom
projections for multiple-scale world maps.
These two kinds of ways have a common feature that
all of the map tiles would be generated in advance and
stored on server side. The map tiles would also be
accessed and stitched up by special pyramid algorithms on
client side. The difference of the two techniques is the
program language, one is JavaScript and the other is
ActionScript. When Ajax map is explored, a number of
corresponding JavaScript file would be downloaded to the
client side. They are usually some unencrypted codes.
Flex map often adopts *.swf file format as a form of
representation. Some map tiles of www.mapabc.com are
as shown in Figure 2.

TABLE I.
Website

HTTP REQUEST URL OF MAIN WEBGIS

Http Request URL

Maps.google.com

http://mt1.google.com/mt?
v=w2.86&hl=zh-CN
&x=6697&y=3364&z=13&s=Galileo

www.mapabc.com

http://emap1.mapabc.com/mapabc/maptile?
v=w2.61&x=837&y=420&zoom=7

www.mapbar.com

http://img1.mapbar.com
/maplite/mapbank/baidu/6/22_7/8_5.png

www.51ditu.com

http://cache2.51ditu.com
/8/1102/8796140208304.png

C. Preventive measure
The http request parameters list above are not
encrypted which make it easy to download all the raster
map tiles from the server side. In order to avoid the bulk
downloading of map tiles, certain preventive measures
must be taken. For example, Google Earth uses
Intermittent IP frozen method to restrict the illegal bulk
downloading. Although non-authorized user can bypass
this restriction through dynamically changing the proxy
server, the difficulty of downloading will undoubtedly
increase. As a kind of effective preventive measure, the
way of encrypting the Http requests is widely adopted.
There are many encryption algorithms for Http request
contents, such as TEA (Tiny Encryption Algorithm) [9],
which is a very simple symmetric encryption algorithm
and its effect of encryption not rely on the complexity of
the algorithms own, but the rounds of encryption. This
algorithm also has a good anti-differential performance.
TEA operates on 64-bit blocks and uses a 128-bit key. It
has a Feistel structure with a suggested 64 rounds,
typically implemented in pairs termed cycles. It also has
an extremely simple key schedule, mixing all of the key
material in exactly the same way for each cycle. Different
multiples of a magic constant are used to prevent simple
attacks based on the symmetry of the rounds [10].
Block TEA operates on arbitrary-size blocks in place
of the 64-bit blocks of the original. It is faster than the
original version when encrypting longer blocks. It is also
simpler to implement in JavaScript for encrypting http
requests. In our study, we adopt the revised Block TEA to
encrypt the http request URL in the Development of
Wuhans WebGIS (www.vrwuhan.com). The main
source code of the JavaScript implementation as below:

Figure 2. Some Map Tiles of www.mapabc.com

B. Security of Client Code

In the publishing process of Tile-Map WebGIS, the
security of client code is very important. And the security
of client code determines whether the geographic data
could be leaked easily. In Ajax map, the source code
without any encryption is very fragile. They usually
records the calling methods of map tiles with plaintext,
which makes the algorithm open and may leak the
organizing structure of the map tiles that stored on server
side. Usually, Ajax maps source code need be encrypted
and confused to improve its own security. The main
encryption methods include JScript.Encode encryption,
decimal html encoding, hex html encoding, hex escaped
character and other escaped characters, etc [7]. The main
confusion methods include removing the indent,
replacing the variable name, using JavaScript keyword as
variable name, eye deluded method, etc [8]. After being
encrypted and confused, the JavaScript source codes
would be more complex and difficult to read, but they
become more robust. However, the source code would be
translated and executed in the Browser on client side,
which determines the essence of its readability. Flex map
program dynamically accesses the map tiles by Action
Script and the source code can also be viewed by
decompile software. Moreover, Crackers still can get the
request parameters by means of blocking tools or find
them in Browsers cache file directory straightly, which
makes the bulk downloading of geographic data becomes
possible. Table 1 list the request URL of main WebGIS
website based on Tile-Map technique. In our study, some

function encrypt (httprequest, key)

{
var v = strToLongs (httprequest);
// convert string to array of longs
var k = strToLongs (key.slice (0, 16));
// simply convert first 16 chars of key
var n = v.length;
var z = v[n-1], y = v[0], delta = 0x9E3779B9;
191

A. Security of Vector Data

The security of vector data in WebGIS based on TileMap technique faces the same potential challenge as the
raster map tiles. Most of the spatial datas transmission
depends on the scripts code executed by the Browser. The
map tile does not posses the spatial information, such as
projection system or the geographic coordinates system.
When the maps are viewed, appropriate tiles will be
accessed and downloaded to the client side, then stitched
up by special algorithms in the clients Browser. The
algorithm will convert the tiles name to corresponding
correct coordinates. In order to recognize the type of
geometry and further identify the attribute information of
special geographical objects in real time, such as roads,
rivers, buildings, the corresponding vector data which be
written in JavaScript file will be transmitted from server
side to client side. So, for improving the security of the
WebGIS based on Tile-Map technique, not only the
contents of http/https requests, but also the value of the
vector data, need be encrypted and confused.
Generally, the data encryption algorithms include key
algorithm and one-way hash algorithms. The latter used
to verify the information. Key algorithms also include
two ways: symmetrical key algorithms (DES, Triple-DES,
RC algorithm, etc) and asymmetrical key algorithm (RSA
algorithm, etc.). Some Scholars have proposed a digital
watermarking algorithm for vector digital maps to
counter such abuses of the maps [14]. The watermark bit is
embedded by displacing an average of coordinates of a
set of vertices that lies in a rectangular area created on a
map by adaptively subdividing the map. But in WebGIS
based on Tile-Map technique, the vector data usually be
transmitted respectively, it is necessary to encrypt the
values of vector data one by one in some time. In our
study, we use the encryption algorithm to encrypt specific
vector data to cipher text and the decryption algorithm to
do the reverse. In this experiment, the WebGIS adopt
WGS-84 coordinates system. The value of longitude and
latitude need be encrypted. We applied the basic
computing operations and 36-bit encoding to encrypt the
specific value. This algorithm belongs to a symmetrical
key encryption algorithm. It is very fast and efficient. The
main source code of the JavaScript implementation as
below:

var mx, e, q = Math.floor (6 + 52/n), sum = 0;

// 6 + 52/n operations gives between 6 & 32 //mixes
on each word
while (q-- > 0) {
sum += delta;
e = sum>>>2 & 3;
for (var p = 0; p < n; p++) {
y = v[(p+1) %n];
mx = (z>>>5 ^ y<<2) + (y>>>3 ^ z<<4) ^
(sum^y) + (k[p&3 ^ e] ^ z);
z = v[p] += mx;
}
}
var ciphertext = longsToStr (v);
// convert array of longs back to string
return ciphertext;
}
III. COPYRIGHT PROTECTION & WATERMARK
Watermarking is the process that embeds data called a
watermark, tag or label into a multimedia object such that
watermark can be detected or extracted later to make an
assertion about the object [11]. Digital watermarking is the
process of embedding information into a digital signal.
The signal may be audio, pictures or video. Most
WebGIS providers adopt digital watermark to protect the
copyright of the map tiles, such as Google, MapBar, etc.
When the map tiles with watermark are bulk downloaded
maliciously, the information is carried in the copies
which help the providers protect their copyright.
According to the human perception, the digital
watermarks can be divide into four different types, such
as visible, invisible, robust, invisible-fragile and dual[12].
Most WebGIS providers used visible watermarking to
protect their copyright. In this kind of watermarking, the
information is visible in map tile. Typically, the
information is text or a logo which identifies the owner of
the tiles. In general, map tiles are synthetic graphics
without complicated color and texture variation, which
makes the embedding of invisible and robust digital
watermarks difficult. Some Scholars propose a waveletbased, threshold-adaptive watermarking scheme (TAWS)
which can embed invisible robust watermarks into
various kinds of graphical images. The inserted
watermarks are adaptively scaled by different threshold
values to maintain the perceptual integrity of
watermarked images and achieve robustness against
compression and signal processing attacks [13].
The insertion algorithm incorporates the watermark
into the object, whereas the verification algorithm
authenticates the object, determining both the owner and
the integrity of the object. The watermarks can be applied
either in spatial or in frequency domain (FFT, DCT or
wavelet). Even though spatial domain watermarking is
less robust, the spatial domain schemes have less
computational overhead compared to frequency domain
schemes. After all, each of the watermarking schemes is
equally important due to its unique applications.
.

SECURITY OF GEOGRAPHIC

function encrypt(la, lo)

{
var key = 222;
// symmetrical key, numeric type
var Ila = parseInt (parseFloat (la)*100000);
// 'la' is the latitude value need to be encrypted
var Ilo = parseInt (parseFloat (lo)*100000);
// 'lo' is the longitude value need to be encrypted
var d = (Ilo-Ila+parseInt (key)).toString (16);
// applied basic computing operations with key
var cipherstr = \'\';
// define the cipher variable
for (var i=0; i<d.length; i++)
{
var t=parseInt (d.charAt (i), 16);

DATA

192

system more secure. The application of security

technology in Web GIS is still in the initial stage, and it
will be an important research trend.

cipherstr +=
(((t>=10)? (TmpInt+7) :t) +10).toString (36)
}
// Encoding the difference with 36-bit, if more
//than 10, add 7, then add 10 for all
return cipherstr

ACKNOWLEDGMENT

}
B. Security of Attribute Data
Attribute data is an important part of WebGIS, and it
covers all of the information in addition to the spatial
location and topological relations of the geographical
objects. Many WebGIS running on internet provide the
service of geographical name searching, such as shops,
restaurants, places and so on. All the attribute information
are classified and can be obtained through http request.
The requests parameters are usually regular, which make
it easy to develop a program to travel request completely.
So, it is also necessary to encrypt and confuse the
requests parameters of attribute data. Block TEA is the
same useful in this aspect. On the other hand, in order to
identify the attribute of each feature in real time, the
spatial information and the entire attribute data are
usually bound in many JavaScript file with plaintext. And
these JavaScript files are often named with regular names.
All of the problems mentioned above proved that the
client codes security is very important, which determines
the security of attribute data deeply.
In addition, WebGIS providers do not have any
restriction on usual attribute datas request, which make
the non-authorized user can obtain the attribute data and
corresponding vector data by traversal requesting. And it
made the security so fragile that the whole system could
be copied easily. So, in the security design of attribute
datas query, providers need to restrict the number of the
search results to avoid the bulk downloading of the
important data.
.

CONCLUSION

Nowadays, Most of WebGIS providers used Tile-Map

technique to publish their maps. In the process of
publishing, many providers ignore the systems security.
The raster map tiles, vector data and attribute data face
different potential security hazard. This paper analyzed
the publishing mode in this technique and discussed the
related security technology, such as encrypting and
confusing the client code, encrypting the http requests,
digital watermarking, encrypting the vector data, etc. This
paper also proposed some methods to make the whole

193

This work was supported by Wuhan Construction

Commission and Wuhan construction research program
200724. The authors would also like to thank Ms. Liu
HaoMr. Jing Zhiqiang and Mr. Guo Mingwu for their
contributions.
REFERENCES
[1] Li Haiting, Fei Lifan, Peng Qingshan, Li Yanhong, The
Application of Pre-generation Thinking in Geographical
Information Services. Journal of Geomatics, 2009,
34(1):31-32.
[2] Sterling Quinn, Jeremy Bartley, David Wilcox,
Implementing and Optimizing ArcGIS Server Map
Caches, 2008 ESRI Developer Summit, March 1720,2008.Palm Springs, CA.
[3] Michael Potmesil, Bell Laboratories, Lucent Technologies,
Maps Alive: Viewing Geospatial Information on the
WWW. Sixth International World Wide Web Conference.
April 7-11, 1997 Santa Clara, California USA.
[4] http://download.oracle.com/docs/cd/B19306_01/appdev.10
2/b14254/geor_intro.htm.
[5] L. D. Paulson, Building rich web applications with ajax.
IEEE Computer, 38(10):1417, Oct 2005.
[6] http://www.flexprojector.com.
[7] Cheng Ru-Zhen, Zhao Min, Liu Hongzhong, Analysis of
Script Language Encode Software on Web. Computer
Engineering and Design, 2006, 27 (6):970-972.
[8] Ma Huan, Xu Jin, Analysis of JavaScript Code
Encryption and Decryption. Science and Technology
Innovation Herald, 2008, (22): 18.
[9] David Wheeler, Roger Needham TEA, A Tiny Encryption
algorithm. England: Cambridge University, 1994.
[10] http://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm.
[11] S. Katzenbeisser and F. A. P. Petitcolas, Information
Hiding techniques for steganography and digital
watermarking, Artech House, Inc., MA, USA, 2000.
[12] S. P. Mohanty, K. R. Ramakrishnan, and M. S.
Kankanhalli, A Dual Watermarking Technique for
Images, in Proceedings of the 7th ACM International
Multimedia Conference (Vol. 2), 1999, 4951.
[13] Po-Chyi Su, C.-C. Jay Kuo, Houng-Jyh M. Wang, Blind
digital watermarking for cartoon and map images, SPIE
proceedings series, San Jose, CA, USA, Monday 25
January 1999.
[14] Ryutarou Ohbuchi, Hiroo Ueda, Shuh Endoh, Robust
watermarking of vector digital maps, ICME 2002,
Lausanne, Switzerland, Aug. 26-29, 2002.