Intelligent warehouse retrieval linkage scheduling method and system for archive security management and control

Abstract

The application discloses an intelligent warehouse retrieval linkage scheduling method and system for archive security control. The method comprises the following steps: receiving a retrieval request and synchronously starting a security control module, and performing identity authentication, permission verification and operation audit in parallel; calculating a comprehensive security level score through a multi-dimensional weighted scoring algorithm; a scheduling controller divides the request into different security level sub-queues according to a preset threshold; a scheduling engine dynamically adjusts the execution priority, device resources and path planning to generate a differentiated scheduling strategy; a driving execution mechanism completes the archive delivery, and an association mapping between the scheduling log and the security event is established through a unified event identifier to realize closed-loop linkage log recording. The application deeply integrates security control and scheduling, eliminates the security blind area, realizes differentiated scheduling based on the security level and full-process traceable audit, and improves the security and controllability of archive retrieval.

Description

Technical Field

[0001] This application belongs to the technical field of computer information processing, specifically relating to an intelligent warehouse retrieval and scheduling method and system for archive security management. Background Technology

[0002] Archival management is gradually developing towards intelligence and automation. Intelligent warehousing systems, by integrating technologies such as dense storage, automated handling, and intelligent identification, have significantly improved the efficiency of archival storage and retrieval and the utilization rate of collection capacity. Among these technologies, retrieval and scheduling technology is a core link in ensuring the efficient circulation of archives. It is mainly used to generate scheduling instructions based on the location of archives, equipment status, and task queues, driving the execution mechanism to complete the retrieval and transportation of archives.

[0003] Most existing intelligent warehouse access scheduling systems focus on optimizing physical access efficiency, exhibiting significant shortcomings in security control. Specifically, the security control module and the scheduling control system are typically designed as independent subsystems, with a sequential coupling in data interaction. This means that access requests only enter the scheduling queue to await resource allocation after security verification. This architecture allows unverified access requests to directly enter the scheduling sequence, creating a security blind spot. Furthermore, the scheduling engine only considers physical location and path optimization factors when generating scheduling policies, failing to provide differentiated responses based on security dimensions such as file classification, user permission level, and operation type. In addition, scheduling logs and security logs are recorded independently, lacking a correlation mapping mechanism, making accurate tracing and rapid location difficult when scheduling anomalies or security incidents occur.

[0004] The aforementioned technical deficiencies are particularly prominent in high-security application scenarios such as classified document management and access to highly sensitive information, hindering the widespread application of intelligent document storage systems in security-sensitive fields. Therefore, there is an urgent need for a technical solution that can achieve deep integration and coordinated operation of security control and access scheduling. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent warehouse access and scheduling method and system for archive security management, which can effectively solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A smart warehouse retrieval and scheduling method for archive security management includes the following specific steps: Upon receiving a request to access archives, the system simultaneously activates the security control module. After receiving the initial signal, the scheduling controller enters a standby state. The security control module performs identity authentication, permission verification, and operation auditing in parallel. Based on the successful identity authentication and permission verification, the system calculates the comprehensive security level score of the access task using a multi-dimensional weighted scoring algorithm, taking into account the archive classification information, user security level, operation type, and time period risk factors. The scheduling controller obtains the comprehensive security level score and, based on the preset security level threshold, distributes the access request to the corresponding security level sub-queue; The scheduling engine dynamically adjusts the execution priority, device allocation priority, path planning range, and resource reservation ratio of the access request based on the security level sub-queue in which the access request is located, and generates differentiated scheduling strategies. The scheduling engine drives the execution mechanism to complete the outbound and transport of files according to the differentiated scheduling strategy. During the entire scheduling process, a correlation mapping between scheduling logs and security events is established through a unified event identifier to complete closed-loop linkage log recording.

[0007] Furthermore, the identity authentication steps specifically include: Obtain biometric authentication factors, dynamic token authentication factors, and digital certificate authentication factors; A weighted fusion algorithm is used to calculate the comprehensive authentication score. The formula for calculating the comprehensive authentication score is as follows: ,in For biometric authentication score, For dynamic token authentication score, For digital certificate authentication score, , , These are the credibility weights for biometric authentication, dynamic token authentication, and digital certificate authentication, respectively, and they satisfy the normalization constraint. The comprehensive authentication score is compared with a preset authentication pass threshold. If the comprehensive authentication score is greater than or equal to the authentication pass threshold, the identity authentication is deemed successful, and an authentication pass identifier containing authentication strength level information is generated.

[0008] Furthermore, the permission verification steps specifically include: A two-dimensional permission mapping matrix model between file security level and user security level is established, and a three-dimensional permission mapping model is constructed by introducing the operation type dimension. The operation types include viewing operation, copying operation, downloading operation, printing operation and exporting operation. The permission verification interface obtains the user security level information of the requesting user and the file confidentiality information of the target file; the permission verification interface queries the three-dimensional permission mapping model using the user security level information, the file confidentiality information, and the requested operation type as indexes; If the correspondence between the user security level information and the file confidentiality information meets the access conditions, and the operation type of the application belongs to the set of allowed operation types in the three-dimensional permission mapping model, then the permission verification is deemed successful.

[0009] Furthermore, the steps for recording the closed-loop linkage log specifically include: Generate a unified event identifier consisting of a task number, timestamp, and event type code; When a security incident occurs, the associated task number is automatically extracted from the security incident record; Retrieve all scheduling log records that match the task number from the scheduling log database; The security event records are associated and bound with the retrieved scheduling log records to form an event-log association dataset; The event-log association dataset is stored in an association analysis database, which supports cross-dimensional queries using time window alignment association analysis strategy, behavior pattern matching association analysis strategy, and causal relationship inference association analysis strategy.

[0010] Furthermore, in the step of calculating the comprehensive security level score of the access task, the multi-dimensional weighted scoring algorithm includes seven dimensions: file confidentiality score, user security level score, operation type score, time period risk factor, department risk coefficient, historical violation record factor, and real-time risk assessment result. The classification score of the archives is assigned 100 points, 80 points, 60 points and 40 points respectively according to the four classification levels of top secret archives, confidential archives, secret archives and internal archives. The user security level score is assigned 0 points, 30 points, and 60 points respectively for high-security level users, intermediate-security level users, and ordinary-security level users. The operation type scoring is based on five operation types: viewing, copying, downloading, printing, and exporting, with scores of 10, 30, 50, 70, and 90 respectively. The formula for calculating the comprehensive security level score is as follows:

[0011] in, Assign a classification score to the aforementioned archives. Assess the user's security level. Rate the operation type. For the time period, risk factors The risk coefficient for the aforementioned department. The historical violation record factor, For the aforementioned real-time risk assessment results, For the classification weight of archives, Assigning weights to user security levels Weights for operation types, For time period risk factor weights, As the departmental risk coefficient weight, Weighting based on historical violation records. Weights are assigned to the immediate risk assessment results.

[0012] Furthermore, in the scheduling queue admission judgment step, the preset security level thresholds include a high security level threshold of 85 points, a medium security level threshold of 60 points, and a low security level threshold of 40 points. The scheduling controller places the access request into a logically independent high-security-level subqueue, a medium-security-level subqueue, or a low-security-level subqueue based on the comparison results between the comprehensive security level score and the high-security-level threshold, the medium-security-level threshold, and the low-security-level threshold. Among them, access requests that fail security verification are immediately terminated and recorded in the interception log, or are marked as suspended and will resume execution from the identity authentication step after the preset suspension release conditions are met.

[0013] Furthermore, the step of dynamically adjusting the scheduling strategy by the scheduling engine specifically includes: Set the execution priority coefficient according to the type of the security level sub-queue; High-security-level tasks are configured with a priority coefficient of 2.5 to 3.0 times the baseline priority, and are equipped with a dedicated execution channel and 50% of the execution mechanism equipment resources are reserved. Medium-security level tasks are configured with a base priority coefficient of 1.5 to 2.0 times, and a shared execution channel is configured with 30% of the execution mechanism equipment resources reserved. Low-security-level tasks maintain a baseline priority and dynamically acquire idle execution device resources using a competitive execution channel; At the same time, the path planning range is adjusted according to the type of the security level sub-queue; High-security-level tasks employ a global path planning strategy, medium-security-level tasks employ a regional path planning strategy, and low-security-level tasks employ a local path planning strategy.

[0014] Furthermore, the specific steps for the scheduling engine to drive the execution mechanism to complete the file retrieval and transport include: The scheduling engine issues a storage command to the stacker crane at the storage location of the target file; The stacker crane performs a combination of horizontal walking, vertical lifting and fork extension to move the files from the target storage area to the outbound platform. The positioning accuracy of the stacker crane is controlled within ±2 mm. The identity information of the file is verified by RFID radio frequency identification technology to confirm the consistency between the file and the outbound instruction; The conveyor speed is dynamically adjusted according to the security classification of the archives to transport them to the sorting station. The sorting station controls the flow of the archives through a baffle mechanism, diverting the archives to the corresponding archive retrieval window or archive transfer channel.

[0015] Furthermore, it also includes the steps for generating and updating scheduling execution reports: After the file scheduling task is completed, the scheduling engine automatically generates a scheduling execution report, which includes basic task information, execution process data, security verification data, abnormal event records, and statistical summary information. The scheduling execution report number and generation time are updated in the corresponding log records and event records in the association mapping database to ensure the integrity and consistency of the association mapping data in the association mapping database.

[0016] Furthermore, the request receiving module is used to receive file access requests and simultaneously trigger a security control process to generate a unique request identifier for the file access request; The security management module adopts an integrated linkage architecture with the scheduling controller. The security management module includes an identity authentication submodule, an authorization verification submodule, and an operation audit submodule that are executed in parallel, and pushes the security verification status to the scheduling controller in real time. The scheduling controller is used to enter a standby state after receiving the initial signal, and to determine whether to allow the file access request to enter the scheduling queue based on the security verification status. The security level scoring calculation module is used to calculate the comprehensive security level score of the access task based on the file classification information, user security level, operation type and time period risk factors, using a multi-dimensional weighted scoring algorithm. The queue admission judgment module is used to divert the file access request to sub-queues of different security levels according to a preset threshold. The strategy adjustment module is used to enable the scheduling engine to dynamically adjust the execution priority, device allocation priority, path planning range, and resource reservation ratio of the file retrieval request based on the comprehensive security level score. The closed-loop linkage log recording module is used to synchronously record scheduling logs and security events throughout the entire retrieval process, assign a unique identifier to each log entry, and establish an association mapping between the scheduling logs and the security events.

[0017] An intelligent warehouse access and scheduling system for archive security management includes: The request receiving module is used to receive file access requests and simultaneously trigger the security control process to generate a unique request identifier for the file access request; The security management module adopts an integrated linkage architecture with the scheduling controller. The security management module includes a parallel-executed identity authentication submodule, a permission verification submodule, and an operation audit submodule, and pushes the security verification status to the scheduling controller in real time. The scheduling controller is used to enter a standby state after receiving the initial signal, and to decide whether to allow the file access request to enter the scheduling queue based on the security verification status. The security level scoring calculation module is used to calculate the comprehensive security level score of the access task based on the file classification information, user security level, operation type and time period risk factors, using a multi-dimensional weighted scoring algorithm. The queue admission judgment module is used to divert file access requests to sub-queues of different security levels according to preset thresholds; The strategy adjustment module enables the scheduling engine to dynamically adjust the execution priority, device allocation priority, path planning range, and resource reservation ratio of file retrieval requests based on the comprehensive security level score. The closed-loop linkage log recording module is used to synchronously record scheduling logs and security events throughout the entire retrieval process, assign a unique identifier to each log entry and establish an association mapping between scheduling logs and security events.

[0018] In summary, this application includes at least one of the following beneficial technical effects: 1. This invention innovatively uses identity authentication, authorization verification, and operation auditing as prerequisites for scheduling control, thereby achieving organic linkage between security management and warehouse scheduling, eliminating blind spots in security management, and ensuring the security and controllability of the entire process of file retrieval.

[0019] 2. This invention dynamically adjusts task priority and scheduling strategy based on multi-dimensional security level scoring, providing priority response and optimized resource allocation for high-security-level files, effectively solving the technical defects of traditional scheduling schemes that lack security dimension considerations.

[0020] 3. This invention synchronously records scheduling logs and security events and establishes a correlation mapping, supporting rapid location and tracing from any dimension, and realizing secure, controllable and auditable management of the entire process.

[0021] 4. This invention divides the scheduling queue into sub-queues with different security levels through a hierarchical management mechanism. The scheduling engine coordinates the execution order of each sub-queue according to the strategy, taking into account both the timeliness requirements of high-security-level tasks and the fairness of ordinary tasks. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the overall technical solution for an intelligent warehouse retrieval and scheduling method for archive security management.

[0023] Figure 2 This is a schematic diagram illustrating the core principle of the integrated architecture of the safety management module and the scheduling controller.

[0024] Figure 3 A schematic diagram of the security control process for identity authentication, authorization verification, and security level score calculation.

[0025] Figure 4 This diagram illustrates the interaction and data flow between the hierarchical management mechanism and differentiated scheduling strategy for high-security-level, medium-security-level, and low-security-level subqueues.

[0026] Figure 5 This is a schematic diagram illustrating the complete audit and traceability process for the closed-loop linkage log recording, scheduling log, and security event association mapping. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the following description is provided in conjunction with the appendix. Figure 1 To be continued Figure 5 The present invention will be further described in detail below with reference to specific embodiments.

[0028] Firstly, this invention provides an intelligent warehouse retrieval and scheduling method for archive security management. This method includes the following implementation steps, constituting a complete integrated linkage process for archive retrieval security management and warehouse scheduling. The following provides a detailed technical description of each step.

[0029] The first step, S1, involves receiving a file retrieval request and simultaneously activating the security control module to achieve seamless integration between security control and warehouse retrieval scheduling. When a user initiates a file retrieval request, this method simultaneously initiates the security control process and pushes the security verification status to the scheduling controller in real time. The scheduling controller enters a standby state before receiving the verification result and dynamically decides whether to allow the request to enter the scheduling queue based on the verification result. This eliminates the time blind spot between security verification and scheduling initiation in traditional solutions. The specific implementation steps are as follows.

[0030] Step S101: Receive and parse the access request, and synchronously trigger the security control process. The security control module and the scheduling controller adopt an integrated linkage architecture.

[0031] When a user initiates a file retrieval request through their terminal device, the request receiving module intercepts the request. This module is responsible for receiving the user's submitted authentication credentials. These credentials include the username, authentication token, and biometric data collected from the user's device. To ensure secure transmission, the authentication credentials are protected via an encrypted channel during transmission. The encryption protocol uses either the Chinese national standard SM4 symmetric encryption algorithm or the AES256 advanced encryption standard.

[0032] After parsing the request content, the request receiving module simultaneously sends a synchronization start command to the identity authentication module, permission verification module, and operation auditing module. Before sending the command, the request receiving module generates a unique request identifier for this access request. The request identifier serves as a correlation index for subsequent processing stages, used to link data throughout the entire process, including identity authentication, permission verification, security level calculation, scheduling execution, and log recording.

[0033] In step S102, the scheduling controller receives the initial signal and enters a standby state. Simultaneously with the activation of the security management module, the scheduling controller receives the initial start signal from the request receiving module. Upon receiving the initial start signal, the scheduling controller does not immediately execute any scheduling operations but instead enters a standby state, waiting for the security management module to return the security verification result.

[0034] After the security verification result is returned, the scheduling controller decides whether to allow the current access request to enter the scheduling queue based on the result, thereby realizing the linkage control between security management and scheduling control.

[0035] In step S103, the three security control sub-modules start and execute in parallel. After the request receiving module completes request parsing, it immediately triggers the three parallel security control sub-modules. The three sub-modules communicate asynchronously through a message queue, with the startup time difference controlled within 10 milliseconds, thereby ensuring the synchronization and consistency of the security control process.

[0036] The three sub-modules function as follows: the identity authentication module is responsible for receiving and processing the user's identity authentication credentials; the permission verification module preloads user permission information and file confidentiality information for subsequent verification; and the operation audit module initializes the audit context and prepares to record the user's operation intent.

[0037] In step S104, the security management module pushes the verification status in real time, and the scheduling controller makes decisions accordingly. After completing the identity authentication and permission verification processes, the security management module pushes the security verification status to the scheduling controller in real time.

[0038] The scheduling controller makes decisions based on the security verification status: if the verification passes, the current access request is allowed to enter the scheduling queue; if the verification fails, the process is terminated and an error message is returned, or the request is suspended according to a preset policy. Through this mechanism, this method achieves seamless integration of security control and warehouse scheduling.

[0039] In summary, step S1 transforms the traditional serial verification-then-scheduling mode into a parallel linkage mode. By synchronously triggering the security control submodule through the request receiving module and keeping the scheduling controller in a standby state to await the verification result, this method ensures that any unverified access request cannot enter the scheduling queue, thereby eliminating the security control blind spot at the process entry point and providing the execution prerequisite for subsequent security-level differentiated scheduling.

[0040] The next step, S2, involves multi-factor authentication. S2 utilizes a pre-defined multi-factor authentication strategy, combining biometric authentication, dynamic token authentication, and digital certificate authentication. A weighted fusion algorithm calculates a comprehensive authentication score, and the score determines whether authentication has succeeded. If authentication fails, the process terminates and an error message is returned. The specific steps are as follows.

[0041] Step S201: Obtain and process biometric authentication factors. The multi-factor authentication strategy supports the fusion authentication of at least three authentication factors, including biometric authentication factors, dynamic token authentication factors, and digital certificate authentication factors.

[0042] Biometric authentication factors can be collected through fingerprint recognition, iris recognition, facial recognition, or finger vein recognition. Users can select one or more of these biometrics for authentication based on their authentication preferences configured in this embodiment.

[0043] The fingerprint recognition module uses a capacitive fingerprint sensor to acquire fingerprint images with a resolution of 508 DPI. The module extracts core and minutiae of the fingerprint using a feature point extraction algorithm, and then compares the extracted fingerprint feature template with a pre-stored user fingerprint template. A similarity threshold of 95% or higher is used to determine that biometric authentication is successful.

[0044] The iris recognition module uses a near-infrared light source to illuminate the user's eyeball and capture an image of the iris texture. The module then extracts the phase feature information of the iris using a Gabor filter and calculates the Hamming distance between the extracted iris feature code and a pre-stored iris code. If the Hamming distance is less than or equal to 0.32, the iris authentication is considered successful.

[0045] The face recognition module uses 3D structured light or dual-camera stereo vision technology to acquire 3D point cloud data of the face. It then extracts a 128-dimensional feature vector of the face using a deep learning convolutional neural network and performs feature matching using a cosine similarity algorithm. A cosine similarity score greater than or equal to 0.92 is considered a successful face authentication.

[0046] The training process for the deep learning convolutional neural network in the face recognition module is as follows: The training data was constructed as follows: facial images were collected under different lighting, poses, and facial expressions, and each image was labeled with its corresponding identity tag. At least 20 facial images under different conditions were collected for each identity to form the training dataset. The dataset was divided into a training set and a validation set in an 8:2 ratio.

[0047] The loss function is a weighted combination of the triplet loss function and the cross-entropy loss function. The triplet loss function has the following form:

[0048] Where *a* represents the feature vector of the anchor sample, *p* represents the feature vector of positive samples with the same identity as the anchor sample, *n* represents the feature vector of negative samples with different identities from the anchor sample, *d* represents the Euclidean distance, and *α* is the margin parameter with a value of 0.2. The cross-entropy loss function uses softmax classification loss. The total loss function is... λ takes the value 0.1.

[0049] The goal of training is to make the feature vectors output by the network satisfy the following: the Euclidean distance between feature vectors of faces with the same identity is as small as possible, the Euclidean distance between feature vectors of faces with different identities is as large as possible, and the classification accuracy is maximized.

[0050] Step S202: Verify the dynamic token authentication factor. The dynamic token authentication factor uses dynamic cryptography technology based on time synchronization or event counting. The user holds a hardware token device or software token application, which generates a 6-digit dynamic password that updates every 30 or 60 seconds.

[0051] Dynamic password verification employs a server-client clock synchronization mechanism. Upon receiving a dynamic password submitted by the user, the server first verifies whether the password's generation timestamp is within a valid time window. A typical configuration for the valid time window is 30 seconds before and after the current time.

[0052] Then, the server regenerates the dynamic password for the current time period locally based on the same algorithm and seed parameters, and compares the dynamic password submitted by the user with the locally regenerated dynamic password. If the two passwords match, the dynamic token authentication factor verification passes.

[0053] Dynamic token authentication also includes a continuity check: verifying whether the sequence number of the current dynamic password is consecutive to the sequence number of the last successful authentication. If the sequence numbers are not consecutive, it is judged as a replay attack and the verification fails.

[0054] Step S203: Verify the digital certificate authentication factor. The digital certificate authentication factor adopts a digital certificate authentication mechanism based on PKI public key infrastructure. The user holds a digital certificate stored in a USB Key or smart card. This digital certificate is issued by an authoritative CA and contains the user's public key information and identity identifier.

[0055] The digital certificate authentication process includes two steps: certificate validity verification and digital signature verification. Certificate validity verification includes checking whether the certificate signature was issued by a trusted CA, whether the certificate is within its validity period, and whether the certificate is listed on a revocation list. If all of the above checks pass, the certificate validity verification is successful.

[0056] The digital signature verification process is as follows: the user signs the authentication challenge information using their private key, and the server verifies the correctness of the signature using the user's public key. If the signature verification is successful, the digital certificate authentication factor verification is passed.

[0057] Step S204: Calculate the comprehensive authentication score based on the weighted fusion algorithm. In this embodiment, the weighted fusion algorithm is used to calculate the comprehensive score according to the credibility weight of various authentication factors.

[0058] Let the biometric authentication score be The dynamic token authentication score is Digital certificate authentication score is The credibility weights of each authentication factor are as follows: , , And it satisfies the normalization constraint. Overall certification score The calculation formula is:

[0059] in: This is the biometric authentication score, ranging from 0 to 100. When biometric authentication is successful, the score is obtained by mapping the matching similarity: 95% matching similarity corresponds to 95 points, and 100% matching similarity corresponds to 100 points, calculated using linear interpolation; the score is 0 points when authentication fails.

[0060] This is the score for dynamic token authentication, with a value of 0 or 100. A score of 100 is given when dynamic token authentication is successful, and a score of 0 is given when authentication fails.

[0061] This is the score for digital certificate authentication, with a value of 0 or 100. A score of 100 is given when the digital certificate authentication is successful, and a score of 0 is given when it fails.

[0062] The trustworthiness weight is configured by balancing the security strength of various authentication factors with user experience: in high-security scenarios, the biometric authentication weight... Set to 0.5, dynamic token authentication weight Set to 0.3, digital certificate authentication weight Set to 0.2.

[0063] In typical security scenarios, biometric authentication weight Set to 0.6, dynamic token authentication weight Set to 0.2, digital certificate authentication weight. Set to 0.2.

[0064] Step S205: Determine whether the identity authentication is successful and generate an authentication identifier, and calculate the overall authentication score. After the calculation is completed, this embodiment will Compare with a preset authentication pass threshold. A typical preset pass threshold is 85 points. If... If the score is 85 or higher, the identity verification is considered successful; otherwise, it is considered unsuccessful.

[0065] If authentication fails, this embodiment terminates the current access process and returns an error message. If authentication succeeds, this embodiment generates an authentication success identifier. This identifier includes an authentication success timestamp and authentication strength level information. The authentication strength level is determined based on the overall authentication score: It is of high strength grade. This is the standard level.

[0066] In summary, step S2 integrates three authentication factors—biometrics, dynamic tokens, and digital certificates—and uses a weighted fusion algorithm to calculate a comprehensive authentication score, achieving multi-dimensional strong identity authentication. This step ensures that only users who pass multi-factor authentication can proceed to subsequent processes, effectively preventing identity forgery and impersonation. The weights in the weighted fusion algorithm can be dynamically adjusted according to the security level, balancing the flexibility requirements of both high-security and general scenarios. The authentication pass identifier generated after successful identity authentication provides a reliable basis for user identity verification in the subsequent step S3.

[0067] The next step, S3, is the permission verification step. This step is performed after successful identity authentication. Based on user permission information, file security level information, and operation type parameters, it calls the permission verification interface to verify whether the user has the necessary access rights to the requested file. If the permission verification fails, a permission denial response is returned, and the following steps are followed.

[0068] Step S301: Establish a two-dimensional permission mapping matrix model between file security level and user security level. In this embodiment, permission verification is performed using a corresponding matrix model based on file security level and user security level.

[0069] The document security classification system divides documents into four levels: Top Secret, Confidential, Secret, and Internal. The user security classification system divides users into three levels: Advanced, Intermediate, and Standard.

[0070] The access rules for different security classification files to users of different levels are as follows: Top secret files are accessible only to users with high security level; confidential files are accessible to users with high and medium security level; secret files are accessible to users with high, medium, and normal security level; internal files are open to users with all security level.

[0071] The above permission rules form a permission mapping matrix. The row index of the permission mapping matrix represents the file security level, the column index represents the user security level, and the matrix elements take values ​​of 0 or 1. A value of 0 indicates access is prohibited, and a value of 1 indicates access is permitted.

[0072] For example, the permission mapping matrix The representation of is: , The matrix's rows, from top to bottom, correspond to three user security levels: High, Medium, and Normal. The columns, from left to right, correspond to four file security levels: Top Secret, Confidential, Secret, and Internal. Elements Indicates the first Level users can access the Grade records.

[0073] The permission mapping matrix is ​​stored in the permission configuration database, supporting dynamic configuration and permission changes. When user permissions or file security levels change, the administrator updates the corresponding element values ​​in the matrix through the configuration interface, without needing to modify the program code.

[0074] Step S302 introduces the operation type dimension to construct a three-dimensional permission mapping model. The operation type parameter defines the categories of user access operations to files, including five operation types: view, copy, download, print, and export.

[0075] Building upon the aforementioned two-dimensional permission mapping matrix of security level and classification, this embodiment further adds an operation type dimension, forming a three-dimensional permission mapping model. The data structure of the three-dimensional permission mapping model is as follows: for each pair (user security level, file classification level), a set of allowed operation types is defined. Alternatively, it can be represented as a three-dimensional matrix. ,in Index for user security levels (1 to 3). For the archive classification index (1 to 4). For operation type indexes (1 to 5). This indicates permission. This indicates a prohibition.

[0076] In the three-dimensional permission mapping model, the conditions for passing permission verification are: the correspondence between the user's security level and the file's confidentiality level satisfies the allowed access conditions in the two-dimensional matrix, and the type of operation requested by the user is within the set of allowed operation types corresponding to that confidentiality level.

[0077] Step S303: The permission verification interface obtains the information required for verification. After receiving the permission verification request, the permission verification interface performs the following data acquisition operations in sequence: First, retrieve the requesting user's security level information from the user information database. The user information database stores data such as the identity identifier, security level, and department of all registered users. The user's security level is pre-assessed and entered by the system administrator based on factors such as the user's job title and confidentiality qualifications.

[0078] Second, retrieve the classification information of the target archive from the archive information database. The archive information database stores metadata such as the archive number, name, classification level, and storage location of all archives. The archive classification level is determined and entered by the administrator based on the sensitivity of the archive content when the archive is entered into the database.

[0079] Third, based on the permission mapping model established in steps S301 and S302, query the corresponding permission rules. Specifically, using the user security level and file classification level as indexes, search the permission mapping matrix to see if access is allowed; using the user security level, file classification level, and operation type as indexes, search the three-dimensional permission mapping model to see if the operation type is within the allowed range.

[0080] Step S304: Compare operation types and determine permission verification results. The permission verification interface compares the operation type submitted by the user with the allowed operation types in the permission rules obtained in step S303.

[0081] If the correspondence between the user's security level and the file's confidentiality level meets the access conditions, and the user's requested operation type belongs to the allowed operation type set, then the permission verification is deemed successful. If either condition is not met, the permission verification is deemed unsuccessful.

[0082] If the permission verification fails, this embodiment returns a permission denial response and records the reason for the denial, such as "user security level is insufficient" or "operation type is not allowed".

[0083] For example: Suppose a user with a medium security level requests to access a confidential file, with the operation type being "print". According to the two-dimensional permission mapping matrix, the medium-level user is allowed to access the confidential file. Then, the three-dimensional permission mapping model is queried to see if the medium-level user is allowed to perform the print operation on the confidential file. If the model is configured so that the confidential file can only be viewed and copied, and not printed, the permission verification fails, and a rejection response is returned.

[0084] In summary, step S3 constructs a two-dimensional permission mapping matrix and a three-dimensional permission mapping model to achieve refined permission verification based on three dimensions: file security level, user security level, and operation type. The two-dimensional matrix handles the correspondence between security level and user security level, while the three-dimensional model further limits the allowed scope of specific operation types. The combination of both ensures that only requests with the corresponding permissions and compliant operation types can proceed to subsequent processes. The permission mapping matrix is ​​stored in a dynamically configurable database, allowing administrators to adjust it according to actual security policies. After this step is completed, approved requests will proceed to the security audit log recording stage in step S4.

[0085] The next step, S4, involves recording the security audit logs. This step is executed after permission verification is completed, and three types of security audit logs are generated and stored simultaneously: identity authentication logs, permission verification logs, and operation audit logs. These logs record the user's authentication results, permission verification conclusions, and access operation intentions, respectively, providing a data foundation for subsequent security tracing and auditing. This is carried out according to the following steps.

[0086] Step S401: Generate an identity authentication log. The identity authentication log records relevant information about the user during the identity authentication process, specifically including the following fields: User Identifier: A unique ID or username that identifies the user; Authentication Time: A timestamp indicating the completion of authentication, accurate to milliseconds; Authentication Method: The combination of multi-factor authentication methods used in this authentication, such as fingerprint + dynamic token or face + digital certificate; Authentication Factor Score Details: Records the biometric authentication scores separately. Dynamic token authentication score Digital certificate authentication score Specific numerical values; comprehensive certification score : The weighted fusion score calculated by step S204; Authentication result: Record whether the authentication is successful or failed.

[0087] When authentication fails, this embodiment records both the failure reason code and a detailed description of the failure. The failure reason code uses predefined enumerated values; for example, 01 indicates a biometric mismatch, 02 indicates a dynamic token verification timeout, and 03 indicates an expired digital certificate. The detailed description of the failure is recorded in natural language text format, providing a convenient way for administrators to troubleshoot.

[0088] Step S402: Generate a permission verification log. The permission verification log records relevant information about the user during the permission verification process, specifically including the following fields: User Identifier: The user ID that initiated the access request; Target File Identifier: The unique number of the file requested for access; User Security Level: The user's security level, which can be high, medium, or ordinary; File Security Level: The security level of the target file, which can be top secret, confidential, secret, or internal; Operation Type: The type of operation requested by the user, including viewing, copying, downloading, printing, or exporting; Permission Rule Matching Result: Records the query results of the two-dimensional permission mapping matrix and the three-dimensional permission mapping model, such as allowing or prohibiting access, and the specific rules violated; Permission Verification Conclusion: Passed or Failed.

[0089] Step S403: Generate an operation audit log. The operation audit log records the user's access intent information, specifically including the following fields: User ID: User ID that initiated the operation; Operation Time: Timestamp of the user submitting the request; Operation Type: Same as the operation type in step S402; Target File ID: File number being operated on; Request Source Terminal Information: Includes the IP address, device fingerprint, or MAC address of the terminal device; Operation Status Description: Records the current status of the operation, such as submitted, awaiting scheduling, completed, or rejected.

[0090] Step S404: Logs are stored using a unified log format and digital signatures are added. All three types of logs are stored using a unified log data format. Each log record contains the following common fields: Timestamp field: Uses ISO8601 standard time format, accurate to milliseconds, e.g., 2024-01-15T14:30:25.123Z. This field ensures the uniqueness and traceability of log timestamps.

[0091] Log type field: Identifies the log category, with values ​​of AUTH (authentication log), PERM (permission verification log), and AUDIT (operation audit log).

[0092] Log content field: Stores the specific content described in steps S401 to S403, saved in JSON format or structured text format.

[0093] Digital signature field: The HMAC-SM3 algorithm is used to calculate the message authentication code for the log content. The HMAC-SM3 algorithm takes as input the log content string and a key known only to the system, and outputs a fixed-length digest value. This digital signature ensures that the log data has not been tampered with during storage and transmission.

[0094] Step S405: Distributed storage of log data. Log storage is deployed using a distributed log service cluster. The primary log node employs a multi-replica storage mechanism, with a maximum of three replicas. Each log record is automatically replicated to these three different physical nodes upon writing. When a node fails, the system can read log data from the remaining replica nodes, thus ensuring high availability and disaster recovery capabilities for the log data.

[0095] In summary, step S4 synchronously generates identity authentication logs, permission verification logs, and operation audit logs, comprehensively recording the entire user operation from authentication to permission verification. These three types of logs employ a unified format and digital signature mechanism to ensure their authenticity and integrity. A distributed multi-replica storage strategy enhances the reliability of the log system. The log data generated in this step will provide raw material for the closed-loop linkage log recording in subsequent step S8, and support the security traceability and auditing requirements of the entire process.

[0096] The next step, S5, involves calculating the security level score for the access task. Based on the file classification information, user security level, operation type, and time period risk factors, a multi-dimensional weighted scoring algorithm is used to calculate the comprehensive security level score of the access task. The weights of each dimension are set according to a preset weight allocation strategy. This score will be used for subsequent admission grading of the scheduling queue and dynamic adjustment of the scheduling strategy, and will be implemented as follows.

[0097] Step S501: Determine the security classification score of the archive. A base score is assigned based on the classification level of the target file: Top Secret Files: Division; Confidential Files: Division; Secret Files: Internal Files: point.

[0098] Step S502: Determine the user's security level score. Assign a base score based on the user's security level: High-security level users: Points (considered low risk); Intermediate security level users: Points; Standard security level user: (This is considered a higher risk).

[0099] Step S503: Determine the operation type score Assign a corresponding baseline score based on the type of operation requested by the user: View operation: Divide; Copy operation: Download operation: Split; Printing operation: Export operation: point.

[0100] Step S504: Determine the values ​​of each risk factor. This step involves three risk factors, and their value selection rules are as follows: First, time-related risk factors Working hours are from 8:00 AM to 6:00 PM, and non-working hours are from 6:00 PM to 8:00 AM the following day, plus statutory holidays. Working hours Outside of working hours .

[0101] Second, departmental risk coefficient Set according to the business nature and security control requirements of the user's department: Departments involving core confidential business. General departments involved in important business operations Support departments involved in general business .

[0102] Third, historical violation record factor The system will be dynamically adjusted based on the user's violation records during the historical review process: users with no violation records... Users with general violation records Users with serious violation records .

[0103] Step S505: Determine the immediate risk assessment results. The real-time risk assessment result is calculated based on a comprehensive analysis of the security posture assessment data for the current period. The assessment data includes factors such as the overall system security alert level, network security threat level, and physical access anomaly alerts. Real-time risk assessment score. The value range is from 0 to 100. This embodiment does not limit the specific comprehensive calculation method, and can be implemented using conventional techniques such as weighted summation or fuzzy evaluation.

[0104] Step S506: Set the weights for each dimension and calculate the overall security level score. This embodiment uses a multi-dimensional weighted scoring algorithm, with the weights for each dimension as follows: document security classification weight. User security level weight Operation type weight Time period risk factor weights Departmental risk coefficient weighting Historical violation record factor weighting Weighting of real-time risk assessment results .

[0105] The above weights satisfy the normalization constraint: .

[0106] Overall security level score The calculation formula is: in: The archives are assigned a security classification score, with values ​​of 40, 60, 80, or 100. The user's security level is scored, with a value of 0, 30, or 60. Rate the operation type with a value of 10, 30, 50, 70, or 90; The time period risk factor is set to 0.8 or 1.5, and multiplied by a fixed baseline score of 100 to obtain the time period risk contribution value. The departmental risk coefficient, with a value of 0.8, 1.0, or 1.3, is multiplied by the file security classification score. Obtain the departmental risk adjustment value; The historical violation record factor, with a value of 0, 10, or 30, is multiplied by a fixed baseline score of 100 to obtain the historical violation risk contribution value. For immediate risk assessment results, values ​​range from 0 to 100; These are the weights for the corresponding dimensions, and a typical configuration is shown above.

[0107] The weighting strategy can be dynamically adjusted according to the security requirements of the actual application scenario. For example, in high-security scenarios, the weight of the file classification level can be appropriately increased. Weighting of real-time risk assessment results Reduce the weight of operation type .

[0108] Step S507: Output the comprehensive security level score, calculated as follows. This score will serve as the basis for the admission judgment of the scheduling queue in step S6. The higher the score, the higher the security level of the task being accessed, and the more priority the task will receive in subsequent scheduling.

[0109] For example: A user with a medium security level requests access to confidential files. The operation type is "view," initiated during working hours. The user belongs to a general department (risk coefficient 1.0), has no historical violation records, and the immediate risk assessment result is 20 points. Then: , , , , , , Substitute into the formula: Calculate each item: A score below 60 will be considered a low-security task.

[0110] Step S5 uses a multi-dimensional weighted scoring algorithm to quantify seven factors—file classification, user level, operation type, time period risk, departmental risk, historical violation records, and real-time risk assessment—into a comprehensive security level score. This score reflects the security sensitivity of the access task, providing a quantitative basis for subsequent hierarchical access control and differentiated scheduling strategies. The weight configuration can be dynamically adjusted according to actual security needs, balancing flexibility and accuracy. The score output from this step is directly input into step S6 to determine which security level subqueue the task should enter.

[0111] For step S6: Perform the admission judgment of the scheduling queue, take the security verification result as a prerequisite, and divert the access request to the sub-queues of different security levels according to the preset threshold, as follows.

[0112] Step S601: Obtain the security verification result and comprehensive security level score. The scheduling controller receives the comprehensive security level score calculated in step S5. The system also includes the security verification results generated in steps S1 to S4. Only when both identity authentication and permission verification pass will the request proceed to the next queue for admission; otherwise, it proceeds to step S604.

[0113] Step S602: Determine the security level based on the comprehensive security level score. This embodiment presets three security level thresholds: high security level threshold of 85 points, medium security level threshold of 60 points, and low security level threshold of 40 points. The determination logic is as follows: like It is classified as a high security level; if It is classified as a medium security level; if This is classified as a low security level. The above thresholds can be dynamically adjusted according to the security requirements of the actual application scenario.

[0114] Step S603: Place the access request into the corresponding security level sub-queue. Based on the determination result of step S602, place the request into a high-security-level sub-queue, a medium-security-level sub-queue, or a low-security-level sub-queue, respectively. The three security-level sub-queues are logically independent of each other, with the high-security-level sub-queue having the highest scheduling priority.

[0115] Step S604: Handle access requests that fail security verification. Interception process: Immediately terminate the request processing flow, record the interception log, generate an interception alarm message, and notify the security monitoring center.

[0116] Suspension Processing: The request status is marked as suspended, the reason for suspension is recorded, and a suspension timestamp is set. Once the preset suspension release conditions are met, this embodiment automatically resumes the request processing flow and restarts from step S1. Suspension release conditions include: the user re-completes identity authentication, the user submits supplementary authentication materials which are approved by the administrator, and the system security alarm level decreases.

[0117] Step S6 implements refined access control for the scheduling queue based on the security verification results and comprehensive security level score. Requests of different security levels are routed to corresponding security level sub-queues using a three-tiered threshold system, providing the queue basis for the differentiated scheduling strategy in step S7. Requests that fail verification are handled by interception or suspension, balancing security and recoverability.

[0118] For step S7, the scheduling strategy is dynamically adjusted. The scheduling engine dynamically adjusts the execution priority, equipment allocation priority, path planning range, and resource reservation ratio of the retrieval task based on the comprehensive security level score calculated in step S5.

[0119] Step S701: Determine the priority coefficient based on the security level score. The scheduling engine sets the execution priority coefficient according to the security level of the task being reviewed: High security level task: priority coefficient is 2.5 to 3.0 times the base priority; Medium security level task: priority coefficient is 1.5 to 2.0 times the base priority; Low security level task: priority coefficient remains unchanged from the base priority.

[0120] Step S702: Configure the execution channel and resource reservation ratio. The scheduling engine adopts differentiated resource allocation strategies for tasks with different security levels. High-security-level tasks are configured with dedicated execution channels, and at least a preset percentage of execution equipment resources are reserved. A typical value for reserving execution equipment resources is 50%. An dedicated execution channel means that a dedicated scheduling and execution line is allocated to high-security-level tasks. This execution line is physically isolated from other security-level tasks and does not compete for resources with the scheduling and execution of other tasks.

[0121] Medium-security-level tasks are configured with a shared execution channel, and at least a preset proportion of execution mechanism equipment resources are reserved. A typical value for the reserved execution mechanism equipment resources is 30%. Medium-security-level tasks are scheduled and executed within the shared execution channel according to the task arrival order and priority coefficient. Tasks within the shared execution channel share the remaining 50% of the execution mechanism equipment resources in this embodiment.

[0122] Low-security-level tasks dynamically acquire available execution mechanism equipment resources through a contention-based execution channel. Within this channel, low-security-level tasks compete for idle execution mechanism equipment resources using a task scheduling algorithm. When execution mechanism equipment resources are scarce, low-security-level tasks are delayed or temporarily suspended.

[0123] Step S703: Adjust device allocation priority. The scheduling engine adjusts the allocation order of actuator devices according to the security level. High-security-level tasks receive the highest allocation priority during the actuator equipment allocation process. The scheduling engine prioritizes allocating high-security-level tasks to actuator equipment that is closest in location and has the best performance.

[0124] Medium-security-level tasks receive medium allocation priority during the execution mechanism equipment allocation process. After fulfilling the execution mechanism equipment requirements of high-security-level tasks, the scheduling engine allocates available execution mechanism equipment to medium-security-level tasks.

[0125] Low-security-level tasks receive the lowest allocation priority during the execution mechanism equipment allocation process. After fulfilling the execution mechanism equipment requirements of high-security-level and medium-security-level tasks, the scheduling engine dynamically allocates execution mechanism equipment to low-security-level tasks based on the availability of execution mechanism equipment.

[0126] Step S704: Adjust the route planning range. The scheduling engine sets different outbound route search strategies based on the safety level. High-security tasks employ a global path planning strategy, searching for the optimal outbound path across the entire warehousing system.

[0127] Medium-security level tasks employ a regional path planning strategy, searching for the optimal outbound path within the region where the target file is located.

[0128] Low-security-level tasks employ a local path planning strategy, searching for feasible outbound paths only near the current storage location of the file.

[0129] Step S7 implements a differentiated scheduling strategy based on a comprehensive security level score, considering four dimensions: priority coefficient, execution channel resources, equipment allocation order, and path planning range. High-security-level tasks receive exclusive resources, the highest priority, and the globally optimal path; medium-security-level tasks receive partial resource guarantees and regional planning; and low-security-level tasks acquire remaining resources through a competitive process. The scheduling instructions output in this step will drive the execution mechanism in step S9 to complete the file retrieval and transport.

[0130] The next step is step S8, which involves executing closed-loop linkage log recording. During the entire retrieval process, scheduling logs and security events are recorded synchronously. A unique identifier is assigned to each log entry, and a mapping between scheduling logs and security events is established to achieve precise association between scheduling behavior and security events.

[0131] Step S801: Generate a unified event identifier. The association mapping model uses the unified event identifier to achieve accurate association between scheduling logs and security events. The unified event identifier is generated by combining three parts: task number, timestamp, and event type code. Task numbers use a 20-bit globally unique encoding format; timestamps use UTC time format accurate to milliseconds; event type codes are represented by 8-bit hexadecimal numbers. The definition rules for event type codes are as follows: authentication event code range: 0x00000001 to 0x000000FF; permission event code range: 0x00000100 to 0x000001FF; scheduling event code range: 0x00000200 to 0x000002FF; security alarm event code range: 0x00000300 to 0x000003FF; system exception event code range: 0x00000400 to 0x000004FF.

[0132] The typical format of a unified event identifier is “TSK-20240115-ABC123-0001|1705312456789|0x00000015”, where “TSK” is the task type prefix, “20240115-ABC123” is the task number, “1705312456789” is the timestamp, and “0x00000015” is the event type code.

[0133] Step S802: Record the scheduling log and security event content. The scheduling log includes the following information: task number, scheduling start time, scheduling end time, executor number, outbound path node sequence, equipment response time, equipment completion time, and task execution status.

[0134] The security incident log includes: incident number, incident time, incident type, incident level, incident source device, incident details description, and associated task number.

[0135] Step S803: Establish the association mapping between scheduling logs and security events. When a security event occurs, this embodiment automatically extracts the associated task number from the security event record, retrieves all scheduling log records that match the task number in the scheduling log database, and associates and binds the security event record with the scheduling log record to form an event-log association dataset.

[0136] The association mapping data is stored in the association analysis database, which supports various association analysis strategies for cross-dimensional querying and tracing.

[0137] Step S804: Execute the association analysis strategy. This embodiment supports the following three association analysis strategies: Time window alignment correlation analysis strategy: Based on the time of the security event, the preset time window width is expanded forward and backward. All scheduling log records are retrieved within the time window range, and scheduling operations that are time-related to the security event are filtered out.

[0138] Behavioral pattern matching and correlation analysis strategy: Based on typical behavioral patterns of historical security events, an abnormal behavior feature database is established. When a new security event occurs, a feature matching algorithm is used to identify historical events similar to the security event, and the scheduling logs associated with similar historical events are used as the associated scheduling logs for the current security event.

[0139] Causal relationship deduction and correlation analysis strategy: Based on the scheduling execution process and the order of security events, a causal relationship graph is constructed, and scheduling operations that have a causal relationship with security events are deduced through graph traversal algorithm.

[0140] In summary, step S8 achieves precise correlation between scheduling logs and security events through a unified event identifier. The process of establishing the correlation mapping is automated, binding the task number in the security event to the matching record in the scheduling log database. Three correlation analysis strategies support cross-dimensional querying and tracing from three dimensions: time, behavioral pattern, and causal relationship, providing a data foundation for the secure, controllable, and auditable management of the entire process. The correlation mapping data output in this step will be used for updating the scheduling execution report and complete tracing in the subsequent step S9.

[0141] Finally, in step S9, the file scheduling execution is completed and a scheduling report is generated. In this step, the scheduling engine drives the execution mechanism to complete the automatic file retrieval and delivery according to the dynamically adjusted scheduling strategy. After the task is completed, a scheduling execution report is automatically generated and the associated log records are updated.

[0142] Step S901: Issue a warehouse retrieval command and control the stacker crane to execute the retrieval. The executing mechanism includes automated logistics equipment such as stacker cranes, conveyor lines, lifting platforms, and transfer devices. After obtaining scheduling execution authorization, the scheduling engine issues a warehouse retrieval command to the executing mechanism at the storage location of the target file. The warehouse retrieval command includes the coordinates of the target storage location, the file identifier, and the warehouse retrieval path sequence.

[0143] After receiving the outbound command, the stacker crane performs three combined actions: horizontal movement, vertical lifting, and fork extension / retraction, moving the documents from the target storage area to the outbound platform. The stacker crane's motion control uses a closed-loop servo control system, with positioning accuracy controlled within ±2 mm.

[0144] Step S902: The file is transported to the sorting station and its identity is verified. After the outbound station receives the file, it starts the conveyor drive motor to transport the file carrier to the designated sorting station. The operating speed of the conveyor is dynamically adjusted according to the security classification of the file: high-security files use a low-speed transport mode.

[0145] After the files are transported to the sorting station, this embodiment uses RFID radio frequency identification technology to verify the identity information of the files. After confirming the consistency between the files and the scheduling instructions, the files are sorted and distributed.

[0146] Step S903: Sorting and routing are performed, and the files are transported to the collection window. The sorting station is equipped with multiple sorting ports, each corresponding to a different file collection window or file transfer channel. The flow of files is controlled by the baffle mechanism of the sorting port. After sorting, the files are transported to the target collection window or transferred to the designated file administrator terminal.

[0147] Step S904: Generate a scheduling execution report. After the task is completed, the scheduling engine automatically generates a scheduling execution report. The report includes the following: Basic task information: Task number, initiating user, target file, execution start time, execution end time, task execution status; Execution process data: action sequence and action time data of each actuator, equipment utilization data, and path planning result data; Security verification data: identity authentication result, permission verification conclusion, security level score, and queuing level; Abnormal event log: The time, content, and handling results of events such as equipment failure, path anomaly, and security alarm that occur during execution; Summary of statistics: total task time, total device usage time, security verification pass rate, and task success rate.

[0148] Step S905: Update the associated log records. After the scheduling execution report is generated, this embodiment synchronously updates the associated log records, updating the scheduling execution report number and generation time to the corresponding log records and event records in the associated mapping database to ensure the integrity and consistency of the associated mapping data.

[0149] Step S9 translates the scheduling strategy into specific physical actions, completing the document outbound and delivery process through stacker crane retrieval, conveyor line transport, RFID verification, and sorting. Upon completion of the task, a scheduling execution report is generated, summarizing the execution process, security verification, and statistical information, and is populated back into the associated mapping database, achieving a closed-loop scheduling system and complete log traceability. After this step, the entire retrieval process concludes.

[0150] To facilitate understanding, the operation flow of the method of this invention will be explained in detail below with a specific application example. Suppose that a manager at a mid-level security level in a classified unit needs to access a confidential file. The manager initiates a access request through a terminal, submitting their fingerprint and dynamic token password.

[0151] Upon intercepting the request, the request receiving module simultaneously initiates the identity authentication, permission verification, and operation auditing modules. With a fingerprint recognition matching rate of 97%, successful dynamic token verification, and a comprehensive authentication score exceeding 85, identity authentication is successful.

[0152] The permission verification module obtains that the user's security level is medium, the file's confidentiality level is confidential, and the operation type is "view". It then queries the permission mapping matrix to determine whether access is permitted.

[0153] The security level scoring module uses a multi-dimensional weighted scoring algorithm, taking into account factors such as file confidentiality level (80 points), user level (30 points), operation type (10 points), working time risk factor (0.8), department risk coefficient (1.0), no historical violations, and real-time risk assessment (20 points), to calculate a comprehensive security level score of 76.

[0154] The scheduling queue admission judgment module places the task into the medium security level sub-queue based on a score of 76 (between the medium threshold of 60 and the high threshold of 85).

[0155] The scheduling engine adjusts execution parameters: the priority coefficient is 1.8 times the baseline, the equipment allocation priority is medium, and a regional strategy is adopted for path planning. A warehouse instruction is issued to the stacker crane, and the documents, after being verified by RFID, are delivered to the management personnel's retrieval window via the conveyor line.

[0156] Throughout the process, events such as identity authentication, permission verification, scheduling execution, and file release are all associated through a unified event identifier. Users can query all relevant logs on the audit interface using the task number to achieve accurate traceability.

[0157] On the other hand, the present invention provides an intelligent warehouse access and scheduling system for archive security management, comprising: The request receiving module is used to receive file access requests and simultaneously trigger the security control process to generate a unique request identifier for the file access request; The security management module adopts an integrated linkage architecture with the scheduling controller. The security management module includes a parallel-executed identity authentication submodule, a permission verification submodule, and an operation audit submodule, and pushes the security verification status to the scheduling controller in real time. The scheduling controller is used to enter a standby state after receiving the initial signal, and to decide whether to allow the file access request to enter the scheduling queue based on the security verification status. The security level scoring calculation module is used to calculate the comprehensive security level score of the access task based on the file classification information, user security level, operation type and time period risk factors, using a multi-dimensional weighted scoring algorithm. The queue admission judgment module is used to divert file access requests to sub-queues of different security levels according to preset thresholds; The strategy adjustment module enables the scheduling engine to dynamically adjust the execution priority, device allocation priority, path planning range, and resource reservation ratio of file retrieval requests based on the comprehensive security level score. The closed-loop linkage log recording module is used to synchronously record scheduling logs and security events throughout the entire retrieval process, assign a unique identifier to each log entry and establish an association mapping between scheduling logs and security events.

[0158] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention. Therefore, the embodiments should be regarded as exemplary and non-limiting in all respects.

[0159] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for intelligent warehouse retrieval and scheduling for archive security management, characterized in that, Includes the following steps: Upon receiving a file access request, the security control module is activated simultaneously. After receiving the initial signal, the scheduling controller enters a standby state. The security control module performs identity authentication, permission verification, and operation auditing in parallel. After the identity authentication and permission verification are passed, the comprehensive security level score of the access task is calculated using a multi-dimensional weighted scoring algorithm based on the file confidentiality information, user security level, operation type and time period risk factors. The scheduling controller obtains the comprehensive security level score and, based on the preset security level threshold, distributes the access request to the corresponding security level sub-queue; The scheduling engine dynamically adjusts the execution priority, device allocation priority, path planning range, and resource reservation ratio of the access request based on the security level sub-queue in which the access request is located, and generates differentiated scheduling strategies. The scheduling engine drives the execution mechanism to complete the outbound and transport of files according to the differentiated scheduling strategy. During the entire scheduling process, a correlation mapping between scheduling logs and security events is established through a unified event identifier to complete closed-loop linkage log recording.

2. The intelligent warehouse access and scheduling method for archive security management according to claim 1, characterized in that, The specific steps of identity verification include: Obtain biometric authentication factors, dynamic token authentication factors, and digital certificate authentication factors; A weighted fusion algorithm is used to calculate the comprehensive authentication score. The formula for calculating the comprehensive authentication score is as follows: ,in For biometric authentication score, For dynamic token authentication score, For digital certificate authentication score, , , These are the credibility weights for biometric authentication, dynamic token authentication, and digital certificate authentication, respectively, and they satisfy the normalization constraint. The comprehensive authentication score is compared with a preset authentication pass threshold. If the comprehensive authentication score is greater than or equal to the authentication pass threshold, the identity authentication is deemed successful, and an authentication pass identifier containing authentication strength level information is generated.

3. The intelligent warehouse access and scheduling method for archive security management as described in claim 1, characterized in that, The specific steps for permission verification include: A two-dimensional permission mapping matrix model between file security level and user security level is established, and a three-dimensional permission mapping model is constructed by introducing the operation type dimension. The operation types include viewing operation, copying operation, downloading operation, printing operation and exporting operation. The permission verification interface obtains the user security level information of the requesting user and the file confidentiality information of the target file; the permission verification interface queries the three-dimensional permission mapping model using the user security level information, the file confidentiality information, and the requested operation type as indexes; If the correspondence between the user security level information and the file confidentiality information meets the access conditions, and the operation type of the application belongs to the set of allowed operation types in the three-dimensional permission mapping model, then the permission verification is deemed successful.

4. The intelligent warehouse access and scheduling method for archive security management according to claim 1, characterized in that, The specific steps for closed-loop linkage log recording include: Generate a unified event identifier consisting of a task number, timestamp, and event type code; When a security incident occurs, the associated task number is automatically extracted from the security incident record; Retrieve all scheduling log records that match the task number from the scheduling log database; The security event records are associated and bound with the retrieved scheduling log records to form an event-log association dataset; The event-log association dataset is stored in an association analysis database, which supports cross-dimensional queries using time window alignment association analysis strategy, behavior pattern matching association analysis strategy, and causal relationship inference association analysis strategy.

5. The intelligent warehouse retrieval and scheduling method for archive security management according to claim 1, characterized in that, In the step of calculating the comprehensive security level score of the access task, the multi-dimensional weighted scoring algorithm includes seven dimensions: file confidentiality score, user security level score, operation type score, time period risk factor, department risk coefficient, historical violation record factor, and real-time risk assessment result. The classification score of the archives is assigned 100 points, 80 points, 60 points and 40 points respectively according to the four classification levels of top secret archives, confidential archives, secret archives and internal archives. The user security level score is assigned 0 points, 30 points, and 60 points respectively for high-security level users, intermediate-security level users, and ordinary-security level users. The operation type scoring is based on five operation types: viewing, copying, downloading, printing, and exporting, with scores of 10, 30, 50, 70, and 90 respectively. The formula for calculating the comprehensive security level score is as follows: ； in, Assign a classification score to the aforementioned archives. Assess the user's security level. Rate the operation type. For the time period, risk factors, The risk coefficient for the aforementioned department. The historical violation record factor, For the aforementioned real-time risk assessment results, For the classification weight of archives, Assigning weights to user security levels Weights for operation types, For time period risk factor weights, As the departmental risk coefficient weight, Weighting based on historical violation records. Weights are assigned to the immediate risk assessment results.

6. The intelligent warehouse retrieval and linkage scheduling method for archive security management according to claim 1, characterized in that, In the admission judgment step of the scheduling queue, the preset security level thresholds include a high security level threshold of 85 points, a medium security level threshold of 60 points, and a low security level threshold of 40 points. The scheduling controller places the access request into a logically independent high-security-level subqueue, a medium-security-level subqueue, or a low-security-level subqueue based on the comparison results between the comprehensive security level score and the high-security-level threshold, the medium-security-level threshold, and the low-security-level threshold. Among them, access requests that fail security verification are immediately terminated and recorded in the interception log, or are marked as suspended and will resume execution from the identity authentication step after the preset suspension release conditions are met.

7. The intelligent warehouse retrieval and scheduling method for archive security management according to claim 1, characterized in that, The specific steps involved in the scheduling engine dynamically adjusting the scheduling strategy include: Set the execution priority coefficient according to the type of the security level sub-queue; High-security-level tasks are configured with a priority coefficient of 2.5 to 3.0 times the baseline priority, and are equipped with a dedicated execution channel and 50% of the execution mechanism equipment resources are reserved. Medium-security level tasks are configured with a base priority coefficient of 1.5 to 2.0 times, and a shared execution channel is configured with 30% of the execution mechanism equipment resources reserved. Low-security-level tasks maintain a baseline priority and dynamically acquire idle execution device resources using a competitive execution channel; At the same time, the path planning range is adjusted according to the type of the security level sub-queue; High-security-level tasks employ a global path planning strategy, medium-security-level tasks employ a regional path planning strategy, and low-security-level tasks employ a local path planning strategy.

8. The intelligent warehouse access and scheduling method for archive security management according to claim 1, characterized in that, The specific steps involved in the scheduling engine driving the execution mechanism to complete the file retrieval and transport include: The scheduling engine issues a storage command to the stacker crane at the storage location of the target file; The stacker crane performs a combination of horizontal walking, vertical lifting and fork extension to move the files from the target storage area to the outbound platform. The positioning accuracy of the stacker crane is controlled within ±2 mm. The identity information of the file is verified by RFID radio frequency identification technology to confirm the consistency between the file and the outbound instruction; The conveyor speed is dynamically adjusted according to the security classification of the archives to transport them to the sorting station. The sorting station controls the flow of the archives through a baffle mechanism, diverting the archives to the corresponding archive retrieval window or archive transfer channel.

9. The intelligent warehouse retrieval and linkage scheduling method for archive security management according to claim 1, characterized in that, It also includes the steps for generating and updating scheduling execution reports: After the file scheduling task is completed, the scheduling engine automatically generates a scheduling execution report, which includes basic task information, execution process data, security verification data, abnormal event records, and statistical summary information. The scheduling execution report number and generation time are updated in the corresponding log records and event records in the association mapping database to ensure the integrity and consistency of the association mapping data in the association mapping database.

10. An intelligent warehouse access and scheduling system for archival security management, used to execute the intelligent warehouse access and scheduling method for archival security management as described in any one of claims 1 to 9, characterized in that, include: The request receiving module is used to receive file access requests and simultaneously trigger the security control process to generate a unique request identifier for the file access request; The security management module adopts an integrated linkage architecture with the scheduling controller. The security management module includes an identity authentication submodule, an authorization verification submodule, and an operation audit submodule that are executed in parallel, and pushes the security verification status to the scheduling controller in real time. The scheduling controller is used to enter a standby state after receiving the initial signal, and to determine whether to allow the file access request to enter the scheduling queue based on the security verification status. The security level scoring calculation module is used to calculate the comprehensive security level score of the access task based on the file classification information, user security level, operation type and time period risk factors, using a multi-dimensional weighted scoring algorithm. The queue admission judgment module is used to divert the file access request to sub-queues of different security levels according to a preset threshold. The strategy adjustment module is used to enable the scheduling engine to dynamically adjust the execution priority, device allocation priority, path planning range, and resource reservation ratio of the file retrieval request based on the comprehensive security level score. The closed-loop linkage log recording module is used to synchronously record scheduling logs and security events throughout the entire retrieval process, assign a unique identifier to each log entry, and establish an association mapping between the scheduling logs and the security events.

Images