# A Usable Encryption Solution for File-Based Geospatial Data within a Database File System
## 2 Security and Usability Concerns for Spatial Files within Enterprise GIS  
While enterprise GIS stores much of its geospatial data in a database, there is still much confidential data in file formats, for instance, shapefiles, geodatabases, and geoJSON files. For the storage and management of these files, traditional file servers have been extensively used in GIS. They provide enterprise users with an easy-to-use interface and adequate security features; however, they can support a limited number of users and lack the _content management_, _reliability_, _scalability_, _availability_, and _security_ features required to manage spatial files in collaborative enterprise GIS environments. As a result, spatial organisations often store files on several file servers, document management systems, web servers, and so on, which affects information access since there is no central repository. In such a data-siloed scenario, applying encryption only adds more complications for users. Traditionally, management and sharing of the most sensitive geospatial data are tasked with on-premise databases and data stores. For further data protection, cryptography is applied during storage using a solution such as Bitlocker on a hard drive, an encrypted geometry column in a database, or over the network using encryption such as SSL [30, 31]. The encryption approach proposed by [PERSON] [32] secures conventional database-based spatial data within an Oracle spatial database. Approaches for protecting spatial files during storage and transfer include those focusing on vector-based files [25, 33, 34, 35, 36, 37] and those focusing on general spatial files [31]. For instance, [PERSON] et al. [31] propose a combination of encryption and digital watermarking techniques, while [PERSON] et al. [38] propose an encryption module for the QGIS software to prevent users from making unauthorised copies of the original data. While these approaches have focused on specific challenges, they are limited in providing an overall encryption solution that _consolidates_ the different spatial file types, further _safeguards_ them using a robust access control mechanism, and provides a _usable_ encryption solution for enterprise GIS. In recent years, technologies and solutions in virtual storage have emerged, and many of these have been widely used by Internet platforms. For geospatial data, there is also a need to _evolve_ traditional file systems and relational database solutions to a distributed, virtual, and software-defined storage system so that storage scalability and processing capability can meet future challenges. Current Big Data integrations on spatial data have mainly focused on structured data and have ignored unstructured (for example, file-based) data [39, 40]. Additionally, as Big Data management is just in its infant stage [41], many of the NoSQL database systems lack encryption mechanisms that support security for data-at-rest and data-in-transit. Cloud-based GI infrastructure and services may be the future of GIS. However, their service providers can track and exert power over data, resulting in rightful custodians relinquishing control [42]. The prominent companies are growing based on the support of the US government [43] and can access data irrespective of its origin using their globally placed servers. This has not only raised concerns around offshore data security and privacy but also the legal and privacy frameworks that the data are subject to. The _MapSafe_ browser-based application [44] and the recent integration of its features in GeoNode [45], permit sovereign data owners to carry out geomasking, encryption, and blockchain notarisation security functions from within the browser by themselves. This furnishes a complete data sovereignty application for safeguarding and verifying geospatial datasets when shared via the cloud without reliance on a third party.