File cabinet internet-of-things access control and data tracing method

Abstract

The invention relates to the technical field of file management, in particular to a file cabinet internet-of-things access control and data tracing method. The method comprises the following steps: firstly, generating a multi-site coupling digital key by extracting identity, authority and terminal characteristics of a borrower; during access verification, a dynamic instruction is used as a logic mask to extract effective site features, and a cabinet door is opened when the effective site features are consistent; then, synthesizing a preorder fingerprint with the identity residue of the borrower, writing the preorder fingerprint back to the physical tag, and generating a progressive fingerprint chain by adopting a cascade hash algorithm in a circulation process; and finally, disassembling the fingerprint chain through a reverse analysis model, and restoring the identity of the borrower in each link in combination with a cosine similarity matching algorithm. According to the method, the problems that offline circulation of the archives is non-traceable, authority verification is easy to crack and data highly depends on a central database are solved, and decentralized auditing and responsibility traceability of the archives in the whole life cycle are achieved.

Description

Technical Field

[0001] This invention relates to the field of archives management technology, and in particular to a method for IoT-based access control and data traceability of archive cabinets. Background Technology

[0002] With the increasing demands for security in document management from enterprises and institutions, informatization and the Internet of Things (IoT) in the document storage and retrieval process have become mainstream trends. Existing document cabinet storage and retrieval control systems typically rely on traditional RFID tags or static digital barcodes for asset management.

[0003] Current access control systems largely rely on single biometric features or static commands, making them highly vulnerable to command interception and replay attacks. Furthermore, they cannot achieve dynamic, strong binding between borrowing permissions and specific tasks. Simultaneously, current technologies generally suffer from the problem of broken links in circulation monitoring. Systems often only record the entry and exit status of files within cabinets; once files enter the offline circulation process between individuals, they fall into a regulatory vacuum. In addition, because data is highly dependent on a central database, in the event of a network outage or database failure, the physical tags attached to the files cannot provide any effective information about the circulation path or the holder's identity, making it extremely difficult to trace responsibility. Summary of the Invention

[0004] To address the above shortcomings, this invention provides an IoT-based access control and data traceability method for filing cabinets, aiming to construct a closed-loop security supervision system covering the entire lifecycle through the high coupling of digital logic and physical sensing.

[0005] This invention provides the following technical solution: a method for IoT-based access control and data traceability of filing cabinets, comprising: S1. Generate a multi-point coupled digital key held by the borrower, and simultaneously receive dynamic instructions issued by the management system that are associated with the borrower and the target file; S2. Match and verify the multiple coupling point features in the digital key with the dynamic instruction. When the two satisfy the preset logical mapping relationship, activate the file cabinet access mechanism. S3. Extract the identity feature parameters and instruction feature values ​​in the matching coupling process, synthesize a pre-access fingerprint with the borrower's identity residual information, and write the pre-access fingerprint into the physical tag carried by the target file; S4. During the process of the file leaving the filing cabinet, the digital key point information of the recipient is obtained and coupled with the previous access fingerprint stored in the physical tag for secondary recombination to generate a progressive fingerprint chain and update it to the physical tag. S5. When responding to a data traceability request, read the fingerprint chain within the physical tag, and by analyzing the residual feature values ​​of each coupling point in the fingerprint chain, reverse-engineer and reconstruct the borrower's identity information at each stage of the circulation path.

[0006] Preferably, in step S1, the step of generating the multi-site coupled digital key held by the borrower includes: Obtain the borrower's basic identity characteristics, the authority weight of their functional department, and the unique identifier of the terminal hardware when initiating the borrowing request; The identity feature value, permission weight and hardware unique identifier are hashed to extract unrelated attribute feature vectors as the initial coupling points of the digital key; The attribute feature vectors are mapped to the key space according to a preset topology, and dynamic perturbation factors generated by timestamps are inserted between each coupling point to generate a digital key.

[0007] Preferably, in step S2, the step of matching and verifying the coupling features of multiple coupling points in the digital key with the dynamic instruction includes: The dynamic instructions are parsed into corresponding logical verification masks, which contain permission filters that match the security level of the target file. The logical verification mask is used to perform bitwise logical operations on the multi-site coupled digital key to extract effective site features in the digital key that are relevant to the current borrowing task; The extracted valid site features are compared with the feature benchmark values ​​pre-stored locally in the filing cabinet. If the two are consistent and the dynamic command is within the preset time window, the verification is deemed successful.

[0008] Preferably, in step S2, the matching coupling verification further includes: When the location characteristics of the digital key do not match the dynamic instruction or the dynamic instruction exceeds the preset time window period, the system identifies it as an illegal access anomaly. Lock the file cabinet access mechanism and temporarily freeze the current borrower's digital key, while simultaneously issuing an alarm notification via mobile terminal; Extract the location conflict characteristics, access attempt time, and current terminal's geographical location information when verification fails, and generate an abnormal access fingerprint.

[0009] Preferably, in step S3, the step of synthesizing a prior access fingerprint containing residual borrower identification information includes: Extract specific site feature vectors that are strongly associated with the borrower's identity from the multi-site coupled digital key, and use them as the original seed for fingerprint synthesis; The authorization hash value in the dynamic instruction is combined with the physical number of the current access authority to generate an access context identifier representing the legitimacy of this access. The specific site feature vector and the access context identifier are fused together using a preset mapping algorithm to generate a pre-access fingerprint.

[0010] Preferably, in step S4, the step of generating a progressive fingerprint chain and updating it to the physical tag includes: Establish a multi-terminal near-field communication link between the transferor, the receiver, and the physical tag, and verify the validity of the receiver's multi-point coupled digital key; Read the preceding access fingerprint stored in the physical tag, extract the digital key point features and transfer timestamp of the receiver, and generate the fingerprint node of the current transfer link through a concatenated hash algorithm; The fingerprint node and the preceding access fingerprint are logically encapsulated to form a progressive fingerprint chain with directional characteristics, ensuring that each level of the fingerprint chain contains the feature summary of the previous stage.

[0011] Preferably, in step S5, the step of reconstructing the borrower's identity information at each stage of the circulation path includes: Read the progressive fingerprint chain in the physical tag and decompose the fingerprint chain into several independent coupled fingerprint nodes according to the generation timeline; The reverse parsing model is invoked, and the feature information of the dynamic instruction is combined to perform demasking calculation and feature separation on each coupled fingerprint node; Extract the residual identity features after separation and perform similarity matching with the pre-stored borrower location feature template to restore the borrower identity information corresponding to each circulation link. The borrower's identity, handover timestamps, and abnormal access records from each stage are arranged chronologically to generate an audit report.

[0012] Preferably, the step of performing similarity matching with pre-stored borrower location feature templates includes: The separated residual bits of identity features are converted into feature vectors to be identified, and the cosine similarity between the feature vectors to be identified and the borrower location feature template is calculated. Determine whether the cosine similarity reaches a preset recognition threshold. If it does, confirm the borrower's identity in the current circulation process.

[0013] The present invention has the following beneficial effects: 1. This invention achieves extremely high-strength access control through deep collaboration between multi-point coupled digital keys and dynamic instruction masks. Unlike traditional static passwords or single-feature verification, this invention solidifies the borrower's physical identity, access rights, and device environment characteristics into multi-point features, and uses the dynamic instructions of the OA system as logical switches for bit-by-bit extraction. This mechanism ensures that access behavior can only be triggered under specific time windows, specific devices, and specific authorized instructions, fundamentally eliminating security risks such as instruction interception and replay, cross-authority borrowing, and identity impersonation.

[0014] 2. This invention utilizes a progressive fingerprint chain with self-carrying identity attributes to construct a decentralized audit closed loop for the entire lifecycle of archives. By writing cascading fingerprints containing residual identity information back into physical tags, this invention breaks the absolute dependence of archive circulation traceability on a central database and real-time network. During the offline circulation process after the archives leave the cabinet, each handover action is logically nested into the fingerprint chain, forming tamper-proof directional evidence. Administrators can perform reverse analysis and similarity restoration of the tag data using only a handheld terminal, accurately identifying the responsible party at each stage of the circulation path, effectively solving the problem of regulatory vacuum when archives circulate outside the cabinet. Attached Figure Description

[0015] Figure 1 This is a flowchart of the IoT-based access control and data traceability method for filing cabinets proposed in this invention. Detailed Implementation

[0016] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1 In a first embodiment of the present invention, the present invention provides a method for IoT-based access control and data traceability of filing cabinets, such as... Figure 1 As shown, it includes the following steps: S1. Generate a multi-point coupled digital key held by the borrower, and simultaneously receive dynamic instructions issued by the management system that are associated with the borrower and the target file; Preferably, in step S1, the step of generating the multi-site coupled digital key held by the borrower includes: Obtain the borrower's basic identity characteristics, the authority weight of their functional department, and the unique identifier of the terminal hardware when initiating the borrowing request; The identity feature value, permission weight and hardware unique identifier are hashed to extract unrelated attribute feature vectors as the initial coupling points of the digital key; The attribute feature vectors are mapped to the key space according to a preset topology, and dynamic perturbation factors generated by timestamps are inserted between each coupling point to generate a digital key.

[0018] In this embodiment, a key generation process based on a 128-bit vector space is used as an example for illustration.

[0019] The system first obtains the following three types of raw data through a mobile client or management terminal: Basic identity feature value ID, such as employee ID or feature summary after facial recognition; The permission weight W is mapped to a numerical weight according to the role definition in the OA system. For example, the top secret level permission corresponds to a prior access fingerprint of 0.9, and the secret level corresponds to 0.5.

[0020] The terminal hardware unique identifier (HID) is used to extract the mobile terminal's IMEI code or network card MAC address.

[0021] The system uses an asymmetric hash algorithm to process the above data, performs truncation and bit extraction, and preferentially selects the SHA-256 hash algorithm to generate three independent feature vectors, among which... , indicating the identity feature site of the preceding fingerprint 32; , indicating the permission feature site of the preceding fingerprint 32 preceding fingerprint bit; This yields the hardware environment location of the 32-bit preceding access fingerprint. These three vectors constitute the initial coupling point.

[0022] This embodiment preferably uses a star topology for mapping, dividing the key space of the 128 preceding fingerprint bits into four quadrants. These are mapped to the first three quadrants respectively. To prevent replay attacks, the system obtains the current Unix timestamp and generates a 32-bit dynamic perturbation factor D using a pseudo-random number generator. D is then inserted into the fourth quadrant of the key space. The final generated digital key... .

[0023] Through the above implementation process, the present invention realizes the cross-dimensional integrated representation of the borrower's physical identity, operating permissions and holding device, and constructs a composite access certificate that has both dynamic anti-counterfeiting capabilities and can be accurately restored to its identity in an offline environment.

[0024] S2. Match and verify the multiple coupling point features in the digital key with the dynamic instruction. When the two satisfy the preset logical mapping relationship, activate the file cabinet access mechanism. Preferably, in step S2, the step of matching and verifying the coupling features of multiple coupling points in the digital key with the dynamic instruction includes: The dynamic instructions are parsed into corresponding logical verification masks, which contain permission filters that match the security level of the target file. The logical verification mask is used to perform bitwise logical operations on the multi-site coupled digital key to extract effective site features in the digital key that are relevant to the current borrowing task; The extracted valid site features are compared with the feature benchmark values ​​pre-stored locally in the filing cabinet. If the two are consistent and the dynamic command is within the preset time window, the verification is deemed successful.

[0025] In this embodiment, after receiving a dynamic instruction from the OA system, the filing cabinet first extracts the security classification field from the instruction. The system generates a corresponding logical verification mask according to preset rules. The mask is a binary sequence of the same length as the digital key. If the target file is of high security classification, the mask will be set to 1 at the corresponding permission weight and identity feature positions to activate filtering, while the mask will be set to 0 at the dynamic disturbance positions to ignore noise. This design ensures that only specific positions authorized by the instruction can proceed to the next step of the calculation.

[0026] The filing cabinet performs a bitwise AND operation between the received digital key K and the logical check mask Mask to obtain the valid point vector. This step can be represented as: This operation clears non-critical perturbation data from the digital key, while extracting identity and permission points relevant to the current borrowing task. This process simulates a catalytic reaction in chemistry, using dynamic instructions as a catalyst to activate the effective components of the digital key.

[0027] The system will extract Feature reference values ​​pre-stored in the local security module A comparison is performed. Simultaneously, the system retrieves the generated timestamp from the instruction. Check the current time Does it meet the following requirements: ,in Set a preset time window, such as 600 seconds. Only when... If the time limit has not expired, the control unit sends an opening pulse to the electronic lock.

[0028] Through the above implementation process, the present invention uses dynamic instructions as logic switches to realize on-demand extraction and time-limited locking of multi-dimensional features within digital keys, ensuring a high degree of strong coupling between physical access behavior and approval intent in both logical and temporal dimensions.

[0029] Preferably, in step S2, the matching coupling verification further includes: When the location characteristics of the digital key do not match the dynamic instruction or the dynamic instruction exceeds the preset time window period, the system identifies it as an illegal access anomaly. Lock the file cabinet access mechanism and temporarily freeze the current borrower's digital key, while simultaneously issuing an alarm notification via mobile terminal; Extract the location conflict characteristics, access attempt time, and current terminal's geographical location information when verification fails, and generate an abnormal access fingerprint.

[0030] In this embodiment, during the matching verification, if the logic unit determines that any of the following conditions are met, an exception process is triggered: Site conflict: The feature bits extracted after masking do not match the baseline value, such as when a borrower attempts to access a high-security file without proper access permissions.

[0031] Expiration Date: The current system time exceeds the start time of the authorized command plus a preset threshold, for example... .

[0032] The main control board of the filing cabinet immediately cuts off the power supply circuit of the electronic lock, forcibly maintaining the locked state.

[0033] The system sends instructions to the mobile terminal and the backend server via an encrypted channel. On the borrower's mobile terminal, the corresponding multi-point coupled digital key status is marked as Disabled, and the borrower's identity is added to a temporary locked list on the server side. At the same time, the terminal triggers a vibration and a high-decibel audio alarm, and a warning containing the filing cabinet number and the borrower's name pops up on the management console.

[0034] Record the specific logical points where verification fails, such as identity verification passing but permission verification failing, and convert this into a conflict signature. In real time, access the mobile terminal's GPS to obtain the geographical location's latitude and longitude, and attach a high-precision timestamp. Perform a hash operation with the aforementioned signature, spatiotemporal parameters, and the currently attempted file ID to generate an abnormal access fingerprint.

[0035] Through the above implementation process, this invention upgrades illegal access behavior from simply denying access to proactive evidence collection. By fingerprinting and solidifying abnormal conflict points and spatiotemporal parameters, it provides tamper-proof original physical evidence for subsequent security audits and accountability.

[0036] S3. Extract the identity feature parameters and instruction feature values ​​in the matching coupling process, synthesize a pre-access fingerprint with the borrower's identity residual information, and write the pre-access fingerprint into the physical tag carried by the target file; Preferably, in step S3, the step of synthesizing a prior access fingerprint containing residual borrower identification information includes: Extract specific site feature vectors that are strongly associated with the borrower's identity from the multi-site coupled digital key, and use them as the original seed for fingerprint synthesis; The authorization hash value in the dynamic instruction is combined with the physical number of the current access authority to generate an access context identifier representing the legitimacy of this access. The specific site feature vector and the access context identifier are fused together using a preset mapping algorithm to generate a pre-access fingerprint.

[0037] In this embodiment, the system extracts a 32-bit specific site feature vector representing the borrower's personal identity from the multi-site coupled digital key of the 128 pre-access fingerprint bits, based on a preset site offset. This vector, serving as the initial seed for fingerprint synthesis, contains remnants of the borrower's identity after hash processing and is the unique digital credential for subsequent reverse identity reconstruction. The filing cabinet's main control unit will receive the authorization hash value from the dynamic instructions. The string is concatenated with the physical number of the current filing cabinet compartment and then processed using a lightweight encryption algorithm to generate a 32-bit access context identifier. .

[0038] The system employs a reversible XOR-based mapping algorithm to transform the original seed... With context identifier Merge the fingerprints to generate the preceding access fingerprints. In this process, through specific mathematical transformations, it becomes possible to achieve... The key feature is located at The data structure exhibits an asymmetric distribution. Finally, the system drives the near-field writing module inside the cabinet to generate the fingerprint. Write the data to the NFC or RFID physical tag that comes with the file.

[0039] Through the above implementation process, the present invention transforms the original instantaneous permission verification action into a digital access certificate with identity and lineage. By embedding identity feature traces in fingerprints, it realizes the technical improvement of the archive transfer certificate from a simple status record to a self-contained identity certificate.

[0040] S4. During the process of the file leaving the filing cabinet, the digital key point information of the recipient is obtained and coupled with the previous access fingerprint stored in the physical tag for secondary recombination to generate a progressive fingerprint chain and update it to the physical tag. Preferably, in step S4, the step of generating a progressive fingerprint chain and updating it to the physical tag includes: Establish a multi-terminal near-field communication link between the transferor, the receiver, and the physical tag, and verify the validity of the receiver's multi-point coupled digital key; Read the preceding access fingerprint stored in the physical tag, extract the digital key point features and transfer timestamp of the receiver, and generate the fingerprint node of the current transfer link through a concatenated hash algorithm; The fingerprint node and the preceding access fingerprint are logically encapsulated to form a progressive fingerprint chain with directional characteristics, ensuring that each level of the fingerprint chain contains the feature summary of the previous stage.

[0041] In this embodiment, at the file handover site, the transferring party and the receiving party jointly activate the NFC pre-access fingerprint reader / writer module on the mobile terminal to establish a three-way near-field communication link with the physical tag attached to the file. The receiving terminal sends its multi-site coupled digital key to the physical tag, and the tag's built-in security logic or the mobile pre-access fingerprint APP verifies whether the site characteristics of the key conform to the current transfer permissions.

[0042] Once authentication is successful, the system performs cascading computations to generate new flow evidence. It reads the most recent access fingerprint from the existing physical tag and records it as... Extract the identity information from the recipient's digital key. and current high-precision transfer timestamps The HMAC-SHA256 algorithm is used, with the preceding fingerprint as the key and the receiver's features and timestamp as the message, to calculate and generate the fingerprint node for the current stage. .

[0043] The system will generate new and Data is encapsulated so that each new fingerprint node contains a feature summary of the preceding fingerprint. This recursive nested structure forms a directional characteristic similar to blockchain; if the fingerprint of any intermediate link is tampered with, all subsequent nodes will break the chain due to verification failure.

[0044] Through the above implementation process, the present invention constructs a progressive evidence chain with logical coupling characteristics by recursively encrypting subsequent features with preceding fingerprints, ensuring that any missing link or identity tampering during the offline transfer of archives can be instantly identified by the system.

[0045] S5. When responding to a data traceability request, read the fingerprint chain within the physical tag, and by analyzing the residual feature values ​​of each coupling point in the fingerprint chain, reverse-engineer and reconstruct the borrower's identity information at each stage of the circulation path.

[0046] Preferably, in step S5, the step of reconstructing the borrower's identity information at each stage of the circulation path includes: Read the progressive fingerprint chain in the physical tag and decompose the fingerprint chain into several independent coupled fingerprint nodes according to the generation timeline; The reverse parsing model is invoked, and the feature information of the dynamic instruction is combined to perform demasking calculation and feature separation on each coupled fingerprint node; Extract the residual identity features after separation and perform similarity matching with the pre-stored borrower location feature template to restore the borrower identity information corresponding to each circulation link. The borrower's identity, handover timestamps, and abnormal access records from each stage are arranged chronologically to generate an audit report.

[0047] Preferably, the step of performing similarity matching with pre-stored borrower location feature templates includes: The separated residual bits of identity features are converted into feature vectors to be identified, and the cosine similarity between the feature vectors to be identified and the borrower location feature template is calculated. Determine whether the cosine similarity reaches a preset recognition threshold. If it does, confirm the borrower's identity in the current circulation process.

[0048] In this embodiment, the tracing terminal reads the data payload from the physical tag via near-field communication. The system identifies specific delimiters in the fingerprint chain and disassembles the nested fingerprint chain into N independent coupled fingerprint nodes in reverse order of the generation timeline. During the disassembly process, the system synchronously verifies the hash pointers between each node to confirm that the chain has not been broken or illegally tampered with.

[0049] The system invokes the reverse analysis model corresponding to step S3, retrieves the dynamic instruction feature set within the file's lifecycle from the OA system, and uses the instruction features as decryption factors to perform a reverse XOR matrix inverse operation on each fingerprint node. Through demasking calculation, environmental noise such as physical numbers and random disturbance terms in the fingerprint can be masked, accurately separating the hidden identity feature residue bits.

[0050] The separated identity feature fragments are converted into feature vectors, and the system retrieves the borrower location feature template library from the backend database. The system calculates the cosine similarity between the separated feature vectors and the vectors of each account in the template library, and sets an identification threshold. When the similarity reaches the threshold, the system automatically associates the data with the corresponding name, employee number, and department, thereby realizing the restoration of the real identity from the residual data.

[0051] The system performs a final structured integration of the restored data, aligning the restored borrower's identity with the handover timestamp extracted from the nodes and the abnormal access fingerprint generated in step S2, to generate a digital audit report of the archive containing five elements: "personnel, time, action, location, and compliance status".

[0052] Through the above implementation process, this invention achieves in-depth mining of solidified data in offline physical tags, and uses reverse decoupling technology to restore fragmented identity remnants into a clear chain of responsibility, thereby providing a closed loop of file audit with high evidentiary value without relying on real-time network connection.

[0053] Example 2 In the file management scenario of a large research institute, a confidential design drawing needs to be circulated among multiple R&D laboratories. Under the traditional management method, once the file leaves the filing cabinet, the transfer relies solely on paper receipts or verbal agreements. If core pages of the file are photographed, replaced, or leaked during the circulation process, it is often difficult to determine the responsible party for the leak because the OA system cannot monitor activities outside the filing cabinet, and there is also a vulnerability where others can impersonate the recipient to sign.

[0054] To address the aforementioned issues, the IoT-based access control and data traceability method for filing cabinets provided by this invention is adopted. The specific implementation process of this method is as follows: A resident of Lab A, identified as Jia, initiated a borrowing request via his mobile phone. The system generated a multi-point coupled digital key based on Jia's biometrics, R&D department permissions, and mobile phone MAC address. Jia successfully verified his identity at the filing cabinet, and the cabinet door opened. At this point, the system extracted Jia's residual identity information, synthesized an initial fingerprint, and wrote it in real time into the NFC physical tag attached to the drawing.

[0055] Person A hands over the blueprints to Person B in Lab B. Person B uses their mobile phone to approach the blueprints, and Person B's digital key point is coupled with Person A's preceding fingerprint in the tag offline. The physical tag automatically generates a progressive fingerprint chain containing the "A-B handover" feature. This process does not require an internet connection, but the identity imprints of both Person A and Person B are logically nested.

[0056] If, during the circulation of drawings, an unauthorized person named C attempts to read or access them, the system detects a conflict between the key point and the instruction mask, denies access, and immediately records C's abnormal access fingerprint in the drawing label, including the time of the attempt and the geographical location.

[0057] The auditing department later discovered that the contents of the drawings had been leaked. They read the physical tag on the drawings using a handheld terminal. The system analyzed the progressive fingerprint chain and, through reverse decoupling calculation and cosine similarity matching, clearly reconstructed that: the drawings were taken out by A and handed over to B at 10:00, and C had illegally accessed them at 10:15.

[0058] With the help of this embodiment, the management department can not only accurately determine the legal holder at each stage, but also achieve closed-loop traceability of "who borrowed, who handled, and who violated the rules" through the fingerprint evidence solidified in the physical tag, completely solving the blind spot of supervision when confidential files circulate outside the cabinet.

[0059] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for IoT-based access control and data traceability of filing cabinets, characterized in that: include: S1. Generate a multi-point coupled digital key held by the borrower, and simultaneously receive dynamic instructions issued by the management system that are associated with the borrower and the target file; S2. Match and verify the multiple coupling point features in the digital key with the dynamic instruction. When the two satisfy the preset logical mapping relationship, activate the file cabinet access mechanism. S3. Extract the identity feature parameters and instruction feature values ​​in the matching coupling process, synthesize a pre-access fingerprint with the borrower's identity residual information, and write the pre-access fingerprint into the physical tag carried by the target file; S4. During the process of the file leaving the filing cabinet, the digital key point information of the recipient is obtained and coupled with the previous access fingerprint stored in the physical tag for secondary recombination to generate a progressive fingerprint chain and update it to the physical tag. S5. When responding to a data traceability request, read the fingerprint chain within the physical tag, and by analyzing the residual feature values ​​of each coupling point in the fingerprint chain, reverse-engineer and reconstruct the borrower's identity information at each stage of the circulation path.

2. The method for IoT-based access control and data traceability of filing cabinets according to claim 1, characterized in that, In step S1, the step of generating the multi-site coupled digital key held by the borrower includes: Obtain the borrower's basic identity characteristics, the authority weight of their functional department, and the unique identifier of the terminal hardware when initiating the borrowing request; The identity feature value, permission weight and hardware unique identifier are hashed to extract unrelated attribute feature vectors as the initial coupling points of the digital key; The attribute feature vectors are mapped to the key space according to a preset topology, and dynamic perturbation factors generated by timestamps are inserted between each coupling point to generate a digital key.

3. The method for IoT-based access control and data traceability of filing cabinets according to claim 1, characterized in that, In step S2, the step of matching and verifying the coupling features of multiple coupling points in the digital key with the dynamic instruction includes: The dynamic instructions are parsed into corresponding logical verification masks, which contain permission filters that match the security level of the target file. The logical verification mask is used to perform bitwise logical operations on the multi-site coupled digital key to extract effective site features in the digital key that are relevant to the current borrowing task; The extracted valid site features are compared with the feature benchmark values ​​pre-stored locally in the filing cabinet. If the two are consistent and the dynamic command is within the preset time window, the verification is deemed successful.

4. The method for IoT-based access control and data traceability of filing cabinets according to claim 1, characterized in that, In step S2, the matching coupling verification also includes: When the location characteristics of the digital key do not match the dynamic instruction or the dynamic instruction exceeds the preset time window period, the system identifies it as an illegal access anomaly. Lock the file cabinet access mechanism and temporarily freeze the current borrower's digital key, while simultaneously issuing an alarm notification via mobile terminal; Extract the location conflict characteristics, access attempt time, and current terminal's geographical location information when verification fails, and generate an abnormal access fingerprint.

5. The method for IoT-based access control and data traceability of filing cabinets according to claim 1, characterized in that, In step S3, the step of synthesizing a prior access fingerprint containing residual borrower identification information includes: Extract specific site feature vectors that are strongly associated with the borrower's identity from the multi-site coupled digital key, and use them as the original seed for fingerprint synthesis; The authorization hash value in the dynamic instruction is combined with the physical number of the current access authority to generate an access context identifier representing the legitimacy of this access. The specific site feature vector and the access context identifier are fused together using a preset mapping algorithm to generate a pre-access fingerprint.

6. The method for IoT-based access control and data traceability of filing cabinets according to claim 1, characterized in that, In step S4, the step of generating a progressive fingerprint chain and updating it to the physical tag includes: Establish a multi-terminal near-field communication link between the transferor, the receiver, and the physical tag, and verify the validity of the receiver's multi-point coupled digital key; Read the preceding access fingerprint stored in the physical tag, extract the digital key point features and transfer timestamp of the receiver, and generate the fingerprint node of the current transfer link through a concatenated hash algorithm; The fingerprint node and the preceding access fingerprint are logically encapsulated to form a progressive fingerprint chain with directional characteristics, ensuring that each level of the fingerprint chain contains the feature summary of the previous stage.

7. The method for IoT-based access control and data traceability of filing cabinets according to claim 1, characterized in that, In step S5, the steps of reconstructing the borrower's identity information at each stage of the circulation path include: Read the progressive fingerprint chain in the physical tag and decompose the fingerprint chain into several independent coupled fingerprint nodes according to the generation timeline; The reverse parsing model is invoked, and the feature information of the dynamic instruction is combined to perform demasking calculation and feature separation on each coupled fingerprint node; Extract the residual identity features after separation and perform similarity matching with the pre-stored borrower location feature template to restore the borrower identity information corresponding to each circulation link. The borrower's identity, handover timestamps, and abnormal access records from each stage are arranged chronologically to generate an audit report.

8. The method for IoT-based access control and data traceability of filing cabinets according to claim 7, characterized in that, The steps for similarity matching with pre-stored borrower location feature templates include: The separated residual bits of identity features are converted into feature vectors to be identified, and the cosine similarity between the feature vectors to be identified and the borrower location feature template is calculated. Determine whether the cosine similarity reaches a preset recognition threshold. If it does, confirm the borrower's identity in the current circulation process.

Images