Secret-related carrier intelligent management system based on RFID technology

Abstract

The invention discloses a confidential carrier intelligent management system based on an RFID technology, and relates to the technical field of big data storage and management, the system comprises an RFID tag module, an RFID reader-writer module, an authority management module, a positioning tracking module, a data storage module, an anomaly detection module, an encryption communication module and an auditing tracing module, the RFID tag module is physically bound with a confidential carrier, and the RFID reader-writer module is used for reading the confidential carrier. The RFID reader-writer module comprises a unique identification code and an encryption chip, the RFID reader-writer module is arranged at an access and a key node position of a management area, the authority management module realizes a four-level authority system, the positioning tracking module adopts a triangulation positioning algorithm to acquire position information in real time, and the data storage module adopts a distributed architecture and a data fragmentation technology. And the anomaly detection module monitors stay, overtime non-return and illegal access attempts in an unauthorized area, and the auditing and tracing module records a complete operation chain, so that automatic identification, real-time tracking, authority control and complete auditing are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, specifically to the branch of big data storage and management technology, and particularly to an intelligent management system for classified carriers based on RFID technology. BACKGROUND

[0002] With the deepening development of informatization construction, the number of classified carriers such as classified files and classified storage media has increased dramatically, and the security management of classified carriers has become an important part of information security work. The traditional management of classified carriers mainly relies on manual registration and paper records, which has the following shortcomings: First, the management efficiency is low, and the manual registration method is time-consuming and labor-intensive, which makes it difficult to achieve fast and accurate registration and query of a large number of classified carriers. When the number of classified carriers reaches several thousand or even tens of thousands, the manual management method cannot meet the actual needs. Second, the tracing ability is insufficient, and the paper record is incomplete, which makes it difficult to accurately trace the complete flow process of the classified carriers. Once a leak occurs, it is difficult to quickly locate the responsible person and the leak link. Third, real-time monitoring is missing. The traditional management method cannot real-time grasp the location and state of the classified carriers, and there is a risk of losing control of the classified carriers, which makes it difficult to discover abnormal situations and take measures in time. Fourth, the permission control is rough, and the manual management method is difficult to achieve fine-grained permission control, which is prone to problems such as permission abuse and unauthorized access, affecting the security of classified carriers. Fifth, the data is stored in a scattered manner. The data generated by the traditional management is stored in various departments, and there is a lack of a unified data management platform, which makes it difficult to conduct comprehensive analysis and statistics and provides effective support for decision-making. Although some RFID-based item management systems have appeared in the prior art, these systems mainly face ordinary item management and are not specifically designed for the particularity of classified carriers. They cannot meet the strict requirements of classified carrier management in terms of security, traceability, and permission management. Therefore, an intelligent management system capable of automatic identification, real-time tracking, permission control, and complete audit of classified carriers is needed to improve the security and efficiency of classified carrier management. SUMMARY

[0003] The present application provides an intelligent management system for classified carriers based on RFID technology to solve the technical problems of low management efficiency, insufficient traceability, lack of real-time monitoring, rough permission control, and scattered data storage of classified carriers in the prior art.

[0004] TECHNICAL SOLUTION To achieve the above-mentioned purpose, the present application adopts the following technical solutions: The application discloses an intelligence management system for secret-containing carriers based on RFID technology. An RFID tag module is used for physical binding with the secret-containing carrier, and the RFID tag module contains a unique identification code and an encryption chip. An RFID reader module is arranged at an entrance and exit position and a key node position of a management area, and is used for reading information of the RFID tag module and performing data interaction. A permission management module is used for storing user identity information and permission level information, and the permission level information includes four levels, i.e., a first secret permission, a second secret permission, a third secret permission and a fourth secret permission. A positioning and tracking module is used for acquiring position information of the secret-containing carrier in real time, and the position information includes area coordinates and a time stamp. A data storage module adopts a distributed storage architecture and is used for storing flow record, operation log and state information of the secret-containing carrier. An abnormality detection module is used for monitoring abnormal behaviors of the secret-containing carrier, and the abnormal behaviors include unauthorized area staying, timeout non-returning and illegal access attempt. An encryption communication module adopts an AES-256 encryption algorithm to perform encryption processing on data transmission between the RFID reader module and a background server. An audit tracing module is used for recording complete life cycle information of the secret-containing carrier and generating a traceable operation chain.

[0005] Further, the RFID tag module includes: A storage unit is used for storing basic attribute information of the secret-containing carrier, and the basic attribute information includes carrier number, secret level type, creation time and belonging department. A tamper-proof unit adopts a physically unclonable function technology and triggers an alarm signal when the RFID tag module is subjected to physical damage. A power management unit adopts a passive power supply mode and obtains working energy through a radio frequency signal emitted by the RFID reader module.

[0006] Further, the data storage module includes: A main storage node is used for storing real-time state data and daily operation record of the secret-containing carrier. Backup storage nodes are arranged at different physical positions and are used for storing historical data and log information. An index management unit establishes a dual-index structure based on a time dimension and a space dimension, the time dimension index is organized according to a year-month-day-hour-minute hierarchical structure, and the space dimension index is organized according to a building-floor-room hierarchical structure.

[0007] Furthermore, the anomaly detection module employs the following detection rules: The area detection rule is to trigger an area anomaly alarm when a classified carrier remains in an unauthorized area for more than 300 seconds. The time detection rule is to trigger an overtime alarm when the borrowing time of classified materials exceeds 120% of the preset return time limit. Frequency detection rules: When the number of times a single user accesses classified media exceeds 150% of a preset threshold within 24 hours, an abnormal frequency alarm is triggered.

[0008] Furthermore, the permission management module verifies user permissions through the following steps: Step S1: Receive the identity authentication information submitted by the user, which includes the employee ID, fingerprint data, and password; Step S2: Query the user's permission level from the permission database; Step S3: Obtain the security classification requirements of the classified carrier to be accessed; Step S4: Compare the user's permission level with the security level requirement of the classified carrier. If the permission level value is less than the security level requirement value, access is denied. If the permission level value is greater than the security level requirement value, access is allowed.

[0009] Furthermore, the positioning and tracking module uses a triangulation algorithm to calculate the position coordinates of the classified carrier. The calculation formula is as follows: ; ; in, The x-coordinate represents the classified carrier, in meters. The vertical coordinate of the classified carrier is shown in meters. , , These represent the x-coordinates of the three RFID readers, in meters. , , These represent the vertical coordinates of the three RFID readers, in meters. , , These represent the weighting coefficients corresponding to the signal strengths received by the three RFID readers. These weighting coefficients are proportional to the signal strength and are calculated using the following formula: ; in, Indicates the first The weighting coefficients corresponding to each RFID reader / writer The values ​​are 1, 2, and 3. Indicates that the classified carrier has reached the 1st The distance between RFID readers, in meters, is calculated using a signal strength attenuation model.

[0010] Furthermore, the operation chain generated by the audit traceability module includes the following fields: Operation sequence number, a unique number that increments sequentially by time; Operation types include lending operations, return operations, query operations, and transfer operations; Operators should record the user's employee ID and name when performing the operation. Operation time, timestamp accurate to the second; Record the location of the RFID reader / writer at the operation location; Classified carrier identification records the unique identification code of the RFID tag; The operation result records the success status.

[0011] Furthermore, the data storage module adopts a data sharding strategy, dividing the operation records of a single classified carrier into multiple data shards according to time periods. Each data shard spans 30 days, and the data shards are stored on different storage nodes.

[0012] Furthermore, the encrypted communication module preprocesses the original data before data transmission. The preprocessing steps include: Step P1: Add timestamps and serial numbers to the original data; Step P2: Generate a data digest using the SHA-256 algorithm; Step P3: Append the data digest to the original data to form the data packet to be encrypted; Step P4: Encrypt the data packet to be encrypted using the AES-256 encryption algorithm; Step P5: Add protocol header information before the encrypted data packet. The protocol header information includes version number, data length and checksum.

[0013] Furthermore, it also includes an emergency response module for executing emergency handling procedures when an anomaly is detected, the emergency handling procedures including: Lock the RFID tags on classified materials and prohibit reading and writing operations. Send an alarm notification to the management personnel, the alarm notification including the type of anomaly, the location of the occurrence, and the identifier of the classified carrier; Activate the video surveillance linkage mechanism and retrieve surveillance footage from the area where the anomaly occurred; Generate emergency incident reports, recording the time, location, personnel involved, and handling measures of the incident.

[0014] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows: First, it improves management efficiency. Through RFID automatic identification technology, it enables rapid registration and query of classified carriers. Compared with manual registration, the identification speed is increased by more than 200 times, and the single operation time is reduced from an average of 180 seconds to 0.8 seconds, which can meet the management needs of large-scale classified carriers.

[0015] Second, enhance traceability capabilities by recording the complete operational chain of classified materials through the audit traceability module, including all operations such as lending, returning, querying, and transferring. Each record is accurate to the second, forming a complete chain of evidence. In the event of a security incident, the specific responsible person and operational link can be located within 30 seconds.

[0016] Third, it enables real-time monitoring. The location information of classified carriers is obtained in real time through the positioning and tracking module, with a positioning accuracy of within 2 meters and a refresh rate of 5 seconds. Managers can use the visual interface to keep track of the distribution status of all classified carriers in real time and promptly detect any abnormalities.

[0017] Fourth, strengthen access control by implementing a four-level access control system through the access control module. Combined with user authentication and security level comparison, it ensures that only personnel with the corresponding permissions can access classified materials of the corresponding security level, effectively preventing abuse of permissions and unauthorized access. The accuracy rate of access verification reaches over 99.9%.

[0018] Fifth, to ensure data security, a distributed storage architecture and data sharding technology are adopted to distribute data across multiple physically isolated nodes, so that a single point of failure will not lead to data loss. The AES-256 encryption algorithm and SHA-256 digital digest technology are used to ensure the security of data transmission and storage, meeting the commercial cryptography standards certified by the State Cryptography Administration.

[0019] Sixth, it supports emergency response. Through the linkage of the anomaly detection module and the emergency response module, an alarm can be triggered within 3 seconds after an abnormal behavior is detected, and tag locking and monitoring retrieval can be completed within 10 seconds, which buys valuable time for emergency response and effectively reduces safety risks.

[0020] Seventh, it facilitates data analysis. It adopts a dual index structure, supports fast retrieval based on time and space, and has a query response time of less than 1 second. Through statistical analysis of operation logs, weaknesses in management can be identified, providing data support for management decisions. Attached Figure Description

[0021] Figure 1 This is an overall architecture diagram of the intelligent management system for classified carriers based on RFID technology according to the present invention; Figure 2 This is a schematic diagram of the RFID tag module of the present invention; Figure 3This is a schematic diagram of the data storage module architecture of the present invention; Figure 4 This is a flowchart of the permission verification process for this invention; Figure 5 This is a schematic diagram illustrating the positioning and tracking principle of the present invention; Figure 6 This is a flowchart of the anomaly detection and emergency response process of the present invention; Figure 7 This is a flowchart of the data encryption transmission process of the present invention. Detailed Implementation

[0022] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0023] Example 1 like Figure 1 As shown, this embodiment provides an intelligent management system for classified carriers based on RFID technology, including an RFID tag module, an RFID reader / writer module, an access control module, a location tracking module, a data storage module, an anomaly detection module, an encrypted communication module, and an audit and traceability module.

[0024] The RFID tag module is physically bound to the classified carrier. The binding method is as follows: RFID tags are affixed to the surface of the classified carrier. The tags are made of anti-transfer material and will be automatically damaged once torn off, making them unusable. Each RFID tag contains a unique identification code with a length of 128 bits. The UUID generation algorithm is used to ensure global uniqueness. An encryption chip is built into the RFID tag to store the basic information of the classified carrier and the access key.

[0025] The RFID reader module is installed at the entrances and exits and key nodes of the management area. In this embodiment, in the scenario of managing classified materials in a 5-story office building, a total of 48 RFID readers are deployed: 2 readers are deployed at the entrances and exits of each floor, 1 reader is deployed at the door of each important office, and 6 readers are deployed in the storage room of classified materials. The readers use the UHF band (860-960MHz), have a reading distance of 8 meters, and support the simultaneous identification of 50 tags. The readers are connected to the back-end server through an Ethernet interface to upload the tag information read in real time.

[0026] The access control module stores user identity information and access level information. User identity information includes employee ID, name, department, position, contact information, and fingerprint data. Access levels are divided into four levels: Level 1 confidentiality corresponds to top secret classified media, Level 2 confidentiality corresponds to confidential classified media, Level 3 confidentiality corresponds to secret classified media, and Level 4 confidentiality corresponds to internal documents. The lower the access level number, the higher the access level. The system administrator can adjust the access level in real time according to changes in personnel positions.

[0027] The positioning and tracking module acquires the location information of classified carriers in real time, such as Figure 5 As shown, when a classified carrier enters the coverage area of ​​an RFID reader, it will be read simultaneously by at least three readers. The system records the RSSI value of the signal strength received by each reader and calculates the distance from the classified carrier to the reader based on the signal strength, using a logarithmic distance path loss model. ; in, Indicates that the classified carrier has reached the 1st The distance between RFID readers is measured in meters. This represents the reference signal strength at a distance of 1 meter from the reader, with a value of -40 dBm. Indicates the first The signal strength received by each reader is expressed in dBm. This represents the path loss index, which is 2.5 in an indoor environment.

[0028] After obtaining the three distance values, calculate the weight coefficients: ; Then, the weighted average method is used to calculate the location coordinates of the classified carrier: ; ; The positioning refresh frequency is once every 5 seconds, and the positioning accuracy can reach 1.5 meters under ideal conditions. The system stores the location information together with the timestamp to form the movement trajectory of the classified carrier.

[0029] The data storage module adopts a distributed storage architecture, such as Figure 3 As shown, it includes one primary storage node and three backup storage nodes. The primary storage node uses SSD solid-state drives with a capacity of 2TB to store real-time status data and daily operation records, ensuring fast read and write performance. The three backup nodes are deployed in the basement, third, and fifth floors of the office building, respectively, with physical isolation. They use SATA mechanical hard drives with a single node capacity of 10TB to store historical data.

[0030] Data sharding strategy: Operation records of a single classified carrier are divided into time periods, with each shard representing 30 days. For example, operation records of a classified carrier from January 1, 2023 to December 31, 2023 are divided into 12 shards, numbered P1 to P12. These 12 shards are then distributed to three backup nodes using a hash algorithm. ; in, This represents the storage node number, with values ​​of 1, 2, and 3. Indicates the data fragment number. This indicates the modulo operation.

[0031] For example, P1 is assigned to node 1, P2 to node 2, P3 to node 3, P4 to node 1, and so on. Each shard stores a copy on all three nodes to ensure data reliability.

[0032] The index management unit establishes dual indexes: the time dimension index is organized according to the hierarchical structure of year-month-day-hour-minute, for example, "2023 / 11 / 15 / 14 / 30" represents 14:30 on November 15, 2023; the spatial dimension index is organized according to the hierarchical structure of building-floor-room, for example, "Building A / 3rd Floor / Room 305". During the query, the data shards can be quickly located according to the time range and spatial range, avoiding full table scans and improving query efficiency by more than 100 times.

[0033] The anomaly detection module monitors abnormal behavior of classified carriers. Area detection: The system predefines authorized and unauthorized areas. Authorized areas include classified carrier storage rooms, users' offices, meeting rooms, etc., while unauthorized areas include public areas such as corridors, restrooms, canteens, and parking lots. When the location tracking module detects that a classified carrier stays in an unauthorized area for more than 300 seconds, it triggers an area anomaly alarm.

[0034] Time detection: Each time classified media is borrowed, the system sets an estimated return time based on the type of classified media and the purpose of borrowing. For example, the return time limit for borrowed documents is generally set to 4 hours, and the return time limit for used classified USB flash drives is generally set to 8 hours. When the actual borrowing time exceeds 120% of the preset return time limit (for example, 120% of 4 hours is 4.8 hours), an overtime alarm is triggered.

[0035] Frequency detection: The system counts the number of times each user accesses classified media within 24 hours and compares it with the user's historical average number of accesses. When the number of accesses on a given day exceeds 150% of the historical average, a frequency anomaly alarm is triggered. For example, if a user historically accesses classified media an average of 10 times per day, and the number of accesses on a certain day reaches 15 times, the system considers the access frequency to be abnormal.

[0036] The encrypted communication module encrypts data transmission, such as... Figure 7 As shown, the data transmission process includes the following steps: Step P1: After the RFID reader reads the tag information, it forms a raw data packet, including fields such as the tag's unique identifier, signal strength, and reading time. The system adds a timestamp (accurate to milliseconds) and a serial number (incrementing number to prevent replay attacks) to the raw data.

[0037] Step P2: Use the SHA-256 algorithm to perform a hash operation on the data after adding the timestamp and sequence number to generate a 32-byte data digest. The input of the SHA-256 algorithm is data of arbitrary length, and the output is a hash value of fixed length 256 bits (32 bytes).

[0038] Step P3: After appending the data digest to the original data, a data packet to be encrypted is formed. The data packet format is: original data + timestamp + sequence number + data digest.

[0039] Step P4: Encrypt the data packet to be encrypted using the AES-256 encryption algorithm. AES uses symmetric encryption with a key length of 256 bits (32 bytes). The system pre-assigns an independent key to each RFID reader / writer. The key is stored in the reader / writer's security chip and is changed every 90 days. The encryption process uses CBC mode (Cryptographic Block Chaining mode). The initialization vector IV is a 16-byte random number, which is regenerated each time encryption is performed.

[0040] Step P5: Add protocol header information before the encrypted data packet. The protocol header includes version number (1 byte, the current version is 0x01), data length (4 bytes, indicating the length of the encrypted data packet), and checksum (2 bytes, calculated using the CRC16 algorithm). The complete transmission data packet format is: protocol header + encrypted data packet.

[0041] The data packet is transmitted to the backend server via Ethernet. After receiving the data packet, the backend server first verifies the checksum in the protocol header, then decrypts the data packet using the key of the corresponding reader / writer, extracts the data digest, recalculates the SHA-256 hash value of the original data, compares whether the two hash values ​​are consistent to verify the data integrity, and finally checks the timestamp and sequence number to prevent replay attacks.

[0042] The audit traceability module records the complete operation chain of classified materials. The operation chain adopts a chain structure, and each record contains a pointer to the previous record, forming an immutable chain of evidence. The record fields include: Operation sequence number: A globally unique incrementing number, starting from 1 and incrementing by 1 with each operation.

[0043] Operation types include lending operations (code 01), return operations (code 02), query operations (code 03), and transfer operations (code 04).

[0044] Operators: Record employee ID (8 digits) and name (maximum 20 Chinese characters).

[0045] Operation time: Uses Unix timestamp format, accurate to the second. For example, 1700035200 represents 14:00:00 on November 15, 2023.

[0046] Operation location: Record the location identifier of the RFID reader, such as "Building A - 3rd Floor - Room 305 - Entrance".

[0047] Classified carrier identifier: Records the unique identifier of the RFID tag, in 128-bit UUID format.

[0048] Operation result: Record whether the operation was successful, 1 indicates success, 0 indicates failure, and record the failure reason code when it fails.

[0049] Forward pointer: Points to the sequence number of the previous operation record of this classified carrier. The pointer is 0 during the first operation.

[0050] Data Summary: Calculate the SHA-256 hash value for all fields in this record to ensure that the record has not been tampered with.

[0051] All operation records are written to the database in real time and backed up synchronously to three backup nodes. The system supports multi-dimensional queries based on conditions such as classified carrier identification, operator, operation time, and operation location, and generates audit reports.

[0052] The emergency response module executes emergency handling procedures when it detects an anomaly, such as... Figure 6 As shown: When the anomaly detection module triggers an alarm, the emergency response module immediately performs the following operations: Step 1: Send a locking command to the RFID tag corresponding to the classified carrier. After receiving the locking command, the RFID tag sets its internal status register to the locked state and refuses to respond to subsequent read and write requests. The locking command is sent through the nearest RFID reader, and the transmission time is less than 1 second.

[0053] Step 2: Send alarm notifications to administrators via SMS, email, and system pop-ups. The alarm notification content includes: anomaly type (area anomaly, timeout anomaly, frequency anomaly, other anomalies), occurrence time (accurate to the second), occurrence location (specific room), identification of classified carrier (label number and carrier name), and personnel involved (employee number and name of the last operator). The alarm notification is sent within 3 seconds after the anomaly occurs.

[0054] Step 3: Activate the video surveillance linkage mechanism. The system connects with the video surveillance system and automatically retrieves the surveillance video of the corresponding area based on the location of the anomaly. The retrieval time range is from 10 minutes before the anomaly occurred to the real-time footage after the anomaly occurred. The surveillance video is automatically saved as evidence material for the incident investigation. The retrieval of surveillance footage is completed within 10 seconds after the anomaly occurs.

[0055] Step 4: Generate an emergency incident report. The report includes: incident number (year, month, day, hour, minute, second + 3 random numbers), incident type, time of occurrence, location of occurrence, information on classified materials, personnel involved, description of the anomaly, system response measures, and processing status (pending, in progress, processed). The report is automatically stored in the database, and administrators can add manual processing comments and processing results.

[0056] Example 2 like Figure 2 As shown in the figure, this embodiment further illustrates the specific structure of the RFID tag module based on embodiment 1.

[0057] The RFID tag module includes a storage unit, an anti-tampering unit, and a power management unit.

[0058] The storage unit uses EEPROM (Electrically Erasable Programmable Read-Only Memory) with a capacity of 8KB, and stores the following content: Carrier ID: 8 bytes, globally unique ID, formatted as department code (2 bytes) + year (2 bytes) + serial number (4 bytes). For example, 01-2023-0001 indicates that the first classified carrier registered by department 01 in 2023.

[0059] Security classification type: 1 byte, with values ​​of 1, 2, 3, and 4, corresponding to Top Secret, Confidential, Secret, and Internal Documents, respectively.

[0060] Creation time: 4 bytes, Unix timestamp format.

[0061] Department: 2 bytes, department code.

[0062] Carrier name: Maximum 64 bytes, UTF-8 encoded, supports Chinese and English.

[0063] Carrier description: Maximum 128 bytes, recording a brief description of the classified carrier.

[0064] Access key: 32 bytes, used for secure authentication with the backend server.

[0065] Access count counter: 4 bytes, records the cumulative number of times this tag has been read.

[0066] Last access time: 4 bytes, records the time when the tag was last read.

[0067] Tag status: 1 byte, with values ​​of 0 indicating normal, 1 indicating locked, and 2 indicating unregistered.

[0068] The tamper-proof unit uses Physically Unclonable Function (PUF) technology. PUF utilizes the physical randomness in the chip manufacturing process to generate a unique, unpredictable, and unclonable digital fingerprint for each chip. When the RFID tag is subjected to physical attacks (such as opening the cover, scratching, laser irradiation, abnormal voltage, etc.), the PUF circuit will detect the environmental change and immediately trigger an alarm signal. The alarm signal is transmitted to the back-end server through the RFID reader, and at the same time the tag automatically enters a locked state, erases the access key, and makes the tag permanently invalid.

[0069] The power management unit adopts a passive power supply method. The RFID tag does not contain a battery. Its working energy comes from the radio frequency signal emitted by the RFID reader. The reader antenna emits electromagnetic waves at a frequency of 915MHz with a power of 1 watt. The RFID tag's built-in antenna receives the electromagnetic waves and converts the radio frequency energy into DC power through a rectifier circuit. The voltage is stabilized at 3.3V to power the tag chip. When the tag leaves the reader's coverage area, it loses power supply and automatically shuts down. The data is stored in EEPROM and is not lost.

[0070] Example 3 This embodiment illustrates the specific process of permission verification, such as... Figure 4 As shown: Step S1: The user requests access to a classified device via a terminal device, which can be a desktop computer, handheld terminal, self-service borrowing and returning machine, etc. The user submits identity authentication information, including: Employee ID: Enter an 8-digit employee ID; Fingerprint data: The fingerprint image is collected by the fingerprint collector, the system extracts fingerprint feature points, and generates a 512-byte feature template; Password: Enter an alphanumeric password of 8-16 characters.

[0071] The system uses three-factor authentication; all three pieces of information must be verified before proceeding to the next step.

[0072] Step S2: The system retrieves the user's detailed information from the permission database based on the employee ID, including name, department, job title, permission level, account status, etc. If the account status is frozen (e.g., the employee has left the company, or the permissions have been temporarily revoked), access is directly denied.

[0073] Step S3: The system queries the carrier database for the classification level requirement of the classified carrier based on the classified carrier identifier requested by the user. For example, a certain document has a classification level of 2 (confidential).

[0074] Step S4: Compare the user's access level with the security classification requirements of the classified media. Both access level and security classification are represented by numerical values; the smaller the value, the higher the level. The comparison rules are as follows: If a user's permission level value is greater than the required security level value, it means that the user's permissions are insufficient, the system will refuse access and return an error message "insufficient permissions". For example, if a user's permission level is 3 (Secret level) and they request access to a carrier with a security level of 2 (Confidential level), since 3>2, access will be denied.

[0075] If the user's permission level value is less than the required security level value, it means that the user's permission is higher than the requirement, and the system allows access and proceeds to the next step. For example, if a user's permission level is 1 (top secret) and they request access to a carrier with a security level of 3 (confidential), since 1 < 3, access is allowed.

[0076] If the user's permission level value equals the security level requirement value, it means the user's permissions match, the system allows access, and proceeds to the next step.

[0077] Step S5: After the permission verification is successful, the system records the access behavior and writes it to the audit log, including information such as access time, access personnel, access carrier, and access result. At the same time, the system sends an authorization instruction to the RFID tag corresponding to the classified carrier, allowing the user to operate on the carrier within a limited time (e.g., 8 hours).

[0078] The entire permission verification process is completed within 1 second, ensuring a smooth user experience.

[0079] Example 4 This embodiment illustrates the specific implementation of data storage and retrieval.

[0080] Data storage uses a MySQL relational database, version 8.0. The database is deployed on the primary storage node and uses a master-slave replication mechanism. Three backup nodes act as slave databases, synchronizing data with the primary database in real time.

[0081] The core data tables include: The carrier information table, carrier_info, stores basic information about classified carriers. The primary key is carrier_id (carrier number), and the fields include carrier_name (carrier name), secret_level (classification level), department (affiliated department), create_time (creation time), and status (status).

[0082] The user information table `user_info` stores basic user information and permissions. The primary key is `user_id` (employee ID), and fields include `user_name` (name), `department` (department), `position` (job title), `permission_level` (permission level), `fingerprint` (fingerprint feature), `password` (password hash value), and `account_status` (account status).

[0083] The operation log table `operation_log` stores all operation records. Its primary key is `log_id` (operation sequence number), and fields include `operation_type` (operation type), `user_id` (operator's employee ID), `carrier_id` (classified carrier number), `operation_time` (operation time), `location` (operation location), `result` (operation result), `previous_log_id` (forward pointer), and `data_hash` (data digest). Due to the large volume of data in this table, it is partitioned by month and year. For example, the `operation_log_202311` table stores data from November 2023.

[0084] The location record table `location_record` stores the location tracking data of classified carriers. The primary key is `record_id`, and the fields include `carrier_id` (classified carrier number), `coordinate_x` (horizontal coordinate), `coordinate_y` (vertical coordinate), `building` (building), `floor` (floor), `room` (room), and `record_time` (recording time). This table has a very large amount of data, recording the location every 5 seconds, generating about 17 million records per day. It is partitioned by day, retaining only the detailed data of the past 30 days. The data from 30 days ago is summarized and compressed, and only the sampling points every 30 minutes are retained.

[0085] The exception_event table stores exception event information. Its primary key is event_id, and its fields include event_type (event type), carrier_id (classified carrier number), user_id (person involved), event_time (occurrence time), location (occurrence location), description (exception description), handle_status (processing status), and handle_result (processing result).

[0086] Index design: Time-based indexes: Create a B-Tree index on the operation_time field of the operation_log table to support fast queries by time range, and create a B-Tree index on the record_time field of the location_record table.

[0087] Spatial dimension index: Create a composite index on the building, floor, and room fields of the location_record table to support fast queries by region.

[0088] Composite indexes: Create a composite index on the user_id and operation_time fields of the operation_log table to support querying the operation records of a user within a certain time period. Create a composite index on the carrier_id and operation_time fields of the operation_log table to support querying the operation records of a carrier within a certain time period.

[0089] Query example: Query the operation records of a classified material during a specific time period: SELECT indicates a query operation, log_id indicates the operation sequence number, operation_type indicates the operation type, user_id indicates the employee ID of the operator, operation_time indicates the operation time, location indicates the operation location, and result indicates the operation result. The FROM keyword is followed by the table name operation_log_202311. The WHERE keyword is followed by the query condition carrier_id equal to a specific value. The AND keyword connects the second condition operation_time to be greater than the start time. The AND keyword connects the third condition operation_time to be less than the end time. The ORDER BY keyword specifies sorting by operation_time in ascending order.

[0090] The query completes within 5 seconds and returns all records that match the criteria.

[0091] Data backup strategy: Real-time backup: Every write operation of the master database is synchronized to the three slave databases via the binary log (binlog). The slave databases replay the SQL statements in the binlog to keep the data consistent with the master database, and the synchronization delay is controlled within 1 second.

[0092] Incremental backup: Perform incremental backup at 2:00 AM every day, export the previous day's operation log to a file, compress it and store it on an offline storage medium (such as a tape library).

[0093] Full backup: A full backup is performed every Sunday at 3:00 AM, taking a snapshot of the entire database, exporting it as an SQL file, compressing it, and storing it on offline storage media.

[0094] Backup file retention period: Incremental backups are retained for 90 days, full backups are retained for 1 year, and backup files exceeding the retention period are archived to the long-term storage system.

[0095] Example 5 This embodiment illustrates the practical application effect of the system.

[0096] A government agency adopted the RFID-based intelligent management system for classified carriers of this invention. The management scope includes a five-story office building with a total of 3,500 classified carriers, including 2,800 classified documents, 500 classified USB flash drives, and 200 classified portable hard drives. There are 280 users from 12 departments.

[0097] System deployment status: 3,500 RFID tags were installed, with one tag attached to each classified carrier; 48 RFID readers were deployed, covering all entrances and exits, important offices and storage areas; Establish one primary storage node and three backup storage nodes, with a total storage capacity of 32TB; Ten self-service borrowing and returning terminals are installed and distributed across each floor. Deploy a central management system, including a web management backend and a mobile app.

[0098] After the system has been running for 6 months, the statistics are as follows: A total of 18,600 transactions involving the borrowing and returning of classified materials were conducted, averaging 103 transactions per day. Compared to manual registration, the average time per transaction was reduced from 180 seconds to 0.8 seconds, saving approximately 5 hours of manual time per day.

[0099] A total of 46.8 million location tracking records were recorded, averaging 260,000 records per day, enabling real-time monitoring of all classified carriers with a positioning accuracy of 1.8 meters.

[0100] There were 62 abnormal alarms triggered, including 38 regional abnormalities, 18 timeout abnormalities, and 6 frequency abnormalities. All abnormalities were handled within 10 minutes, and no loss or leakage of classified materials occurred.

[0101] The audit log contains a total of 210,000 entries, providing a complete record of all operations and detailed data support for two internal audits and one inspection by a higher authority.

[0102] A total of 19,200 permission verifications were performed, and 36 unauthorized access attempts were rejected, resulting in a 100% accuracy rate for permission verification.

[0103] The system availability reached 99.8%, with only one planned maintenance downtime of 2 hours.

[0104] User satisfaction surveys show that 95% of users believe the new system has improved work efficiency, 92% believe it has enhanced security, and 88% believe it is easy to use.

[0105] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An intelligent management system for classified carriers based on RFID technology, comprising a management system, characterized in that: The management system comprises: An RFID tag module for physical binding with the classified carrier, the RFID tag module containing a unique identification code and an encryption chip; An RFID reader module arranged at the entrance and exit positions and key node positions of the management area for reading the information of the RFID tag module and interacting data; A permission management module for storing user identity information and permission level information, the permission level information including four levels, namely, first-class secret permission, second-class secret permission, third-class secret permission and fourth-class secret permission; A positioning and tracking module for real-time acquisition of position information of the classified carrier, the position information including area coordinates and time stamps; A data storage module adopting a distributed storage architecture for storing the flow record, operation log and state information of the classified carrier; An abnormality detection module for monitoring abnormal behaviors of the classified carrier, the abnormal behaviors including unauthorized area stay, timeout non-return and illegal access attempt; An encrypted communication module for encrypting the data transmission between the RFID reader module and the background server by using an AES-256 encryption algorithm; An audit traceability module for recording the complete life cycle information of the classified carrier and generating a traceable operation chain. 2.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The RFID tag module comprises: A storage unit for storing basic attribute information of the classified carrier, the basic attribute information including carrier number, secret level type, creation time and ownership department; A tamper-proof unit adopting a physically unclonable function technology to trigger an alarm signal when the RFID tag module is physically damaged; A power management unit adopting a passive power supply mode to obtain working energy through the radio frequency signal emitted by the RFID reader module. 3.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The data storage module comprises: A main storage node for storing real-time state data and daily operation records of the classified carrier; Backup storage nodes arranged at different physical locations for storing historical data and log information; An index management unit establishing a dual-index structure based on time dimension and space dimension, the time dimension index being organized in a hierarchical structure of year-month-day-hour-minute, and the space dimension index being organized in a hierarchical structure of building-floor-room.

4. The system according to claim 1, characterized in that: The abnormality detection module adopts the following detection rules: A region detection rule for triggering a region abnormality alarm when the classified carrier stays in an unauthorized area for more than 300 seconds; A time detection rule for triggering a timeout abnormality alarm when the classified carrier is borrowed for more than 120% of the preset return time limit; A frequency detection rule for triggering a frequency abnormality alarm when the same user accesses the classified carrier more than 150% of the preset threshold within 24 hours. 5.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The permission management module verifies the user permission through the following steps: Step S1: receiving user-submitted identity authentication information, the identity authentication information including a work number, fingerprint data and a password; Step S2: querying the permission level of the user from the permission database; Step S3: acquiring the secret level requirement of the classified carrier to be accessed. Step S4: comparing the user's permission level with the classified level requirement of the classified carrier, when the permission level value is less than the classified level requirement value, access is denied, when the permission level value is greater than the classified level requirement value, access is allowed. 6.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The positioning tracking module calculates the position coordinates of the classified carrier using a triangular positioning algorithm, and the calculation formula is: ； ； wherein, represents the horizontal coordinate of the secret-related carrier, in meters, represents the vertical coordinate of the secret-related carrier, in meters, , , respectively represent the horizontal coordinates of the three RFID readers, in meters, , , respectively represent the vertical coordinates of the three RFID readers, in meters, , , respectively represent the weight coefficients corresponding to the signal strengths received by the three RFID readers, the weight coefficients are proportional to the signal strengths, and the calculation formula is: ； wherein, represents the weight coefficient corresponding to the RFID reader, takes the value of 1, 2, 3, represents the distance from the secret-involved carrier to the RFID reader, in meters, calculated by a signal strength attenuation model. 7.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The operation chain generated by the audit tracing module includes the following fields: Operation serial number, unique number in chronological order; Operation type, including lending operation, returning operation, querying operation and transferring operation; Operation personnel, recording the user ID and name of the operation; Operation time, time stamp accurate to seconds; Operation location, recording the location identification of the RFID reader; Classified carrier identification, recording the unique identification code of the RFID tag; Operation result, recording the operation success status. 8.The system according to claim 3, characterized in that: The data storage module uses a data sharding strategy to divide the operation records of a single classified carrier into multiple data shards according to time periods, and each data shard has a time span of 30 days, and the data shards are stored in different storage nodes. 9.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The encryption communication module pre-processes the original data before data transmission, and the pre-processing steps include: Step P1: adding a timestamp and a serial number to the original data; Step P2: generating a data digest using the SHA-256 algorithm; Step P3: attaching the data digest to the original data to form a data package to be encrypted; Step P4: encrypting the data package to be encrypted using the AES-256 encryption algorithm; Step P5: adding protocol header information in front of the encrypted data package, the protocol header information includes version number, data length and check code. 10.The RFID technology-based intelligent management system for secret-containing carriers according to claim 1, characterized in that: The management system also includes an emergency response module for executing an emergency handling process when an abnormal situation is detected, the emergency handling process includes: Locking the RFID tag of the classified carrier to prohibit read-write operations; Sending an alarm notice to the management personnel, the alarm notice includes the type of abnormality, the location of occurrence and the identification of the classified carrier; Starting the video monitoring linkage mechanism to retrieve the monitoring video of the area where the abnormality occurred; Generating an emergency event report to record the time, location, involved personnel and handling measures of the event.

Images