# Protection of Digital Elevation Model--One Approach
## 3 Results
### A Model for Non-Repudiation and Protect DEM Data  
The model is designed to meet the security requirements of sensitive information systems. Geographic information systems are of great importance in the military because they provide information on the geographic area necessary for planning the deployment of military forces. The army must have accurate and reliable data on the geographic area in which it operates. Operation planners can obtain geographic information (e.g., DEM data) via a computer network or a portable medium. It is very important that there is trust in the DEM data source, that they have not been changed regarding the original data, that the data source cannot deny that the DEM data originate from it, that the enemy does not come into possession of the data, and that there is trust between the parties using the DEM data.  
For this purpose, the authors developed a model for securing the transfer of non-repudiated and protected DEM data in security-sensitive systems (Figure 3). The model aims to enable authentication, integrity, non-repudiation, the privacy of the message, and trust of the parties in communication. The model is described on the sender's side and the recipient's side. On the sender's side, the following steps are followed before the message is sent:  
* Checking the digital identity of the message recipient;
* Digitally signing and creating the structure of a digitally signed object;
* Generating a secret key for DEM data protection during a transfer;
* Encrypting a message and a secret key;
* Forming of DEM-protected structure delivered to the recipient.  
On the side of the recipient, the following steps are followed:  
* Deconcatenation of the message;
* Deciphering the secret key and message;
* Separating the PKI structure from the message;
* Checking the sender's digital identity;
* Digital signature verification.  
First performed is the recipient's digital certificate check on the sender's side. Checking the certificate implies verification of the certificate chain, validity period, and certificate status (1). Verification of the certificate chain proves trust on the other side. The validity period and CRL check determine whether the certificate is still valid. If the certificate verification is not successful, then the sender cannot trust the recipient. Digital signing of the DEM data by the public key of the sender is performed after a successful check (2). From the received digital signature and the created PKI object (3), a digitally signed object is created (4). The PKI object contains the trust path, the CRL, and the sender's certificate. The DSO is added to the DEM data and forms a digitally signed DEM message (5). The nextstep is generating a secret key (6) for encrypting the DEM data (7). At the same time, the secret key is encrypted by the message recipient's public key (8). The encrypted message and the encrypted secret key are merged (9) and sent to the message recipient.  
On the recipient side, the message is split into the part related to the message and the part related to the secret key (10). The encrypted secret key is decrypted with the private key of the recipient that corresponds to the public key (11). The message is decrypted by a secret key (12). The decrypted message splits into the DSO part and the DEM data (13). The DSO part is separated into a PKI object (14), from which is performed the verification of the sender's certificate (15). If the verification is successful, then begins the digital signature verification (16). Otherwise, the message is rejected (17) because there is no trust in the message sender. After successful digital signature verification, the recipient accepts the message as an authentic and unchanged item (18). Now, the recipient of a DEM message may consider that only he has insight into the content of the message and that the sender cannot deny that he has sent the message.