智慧粮库建设解决方案

一、建设目标    紧紧围绕现代粮库管理发展要求和“西部某粮食储备库行业十三五发展规划”，深化信息技术在粮库智能化、安防监控各个环节的应用。到2016年，初步构建起以“信息基础设施先进、信息资源充分开发、技术应用快速成发展”为主要标志，以“数字化政务、精确化业务、网络化服务、智能化智慧”为主要内容的“智慧粮食”基本框架，形成结构完整、功能齐全、安全稳定、信息共享、多级联动、覆盖全省的较为完善的粮库信息管理平台，信息资源共享、开发利用和社会服务水平全面提升，支撑粮食宏观调控科学决策和产业发展转型升级的能力大幅提高，全省粮食信息化水平居全国前列。二、建设内容深入推进智慧粮库建设，建设全省统一的综合信息基础设施，粮库管理数据中心，实现全省粮库信息集中、统一监控、统一指挥；形成两个体系，分别是信息化标准体系和信息安全体系。主要包括：1.综合信息基础设施建设。充分利用省政府政务内网资源，建设完成覆盖省、库两级的纵向网，同时省、库两级分级各自建设完善机关内部局域网，形成纵向网与分级局域横向联合向网互联互通的西部某粮食储备库信息网络。2.粮食管理数据中心建设。通过开发完善统一数据接口的主要业务管理系统，整合各类业务数据信息资源，着重建设粮食仓库地理信息数据库、粮库基本数据库等一批粮食信息资源基础数据库群，逐步完善形成全省粮食管理数据存储、处理、分析和服务中心，并依据管理权限，建立省级中心。以此为基础，建成以GIS技术（地理信息系统）应用为核心的全省规模的粮库基础数据动态监测体系，建设粮食应急指挥、宏观调控、预警预报、决策支持等系统，信息资源得到深度发掘和广泛利用，信息产品日益丰富。3.业务管理信息化建设。建设业务协同、多级联动的一体化的粮食政务管理和粮食业务管理统一平台。在此平台下，依据业务门类，开发完善统一数据接口的主要业务管理系统，全面提高行政效能、流通监管和宏观调控支持能力。支持和鼓励仓储企业粮库信息化系统（包括粮情测控统）、感知物联网技术、加工企业全过程自动控制等待业信息化技术项目的试点和推广应用。4.信息化标准体系建设。结合系统开发，分步研究制定信息网络和硬件设备技术标准、粮食行业信息数据源采集基础标准、信息分类和编码数据标准、信息技术应用标准和信息化安全技术标准，逐步形成粮食信息化标准体系，促进资源共享，鼓励先行先试，提高信息资源整体开发利用效率。5.信息安全体系建设。在实现资源共享和开发利用的同时，确保网络与信息运行安全。建立信息网络安全监管组织领导机制，形成全省统一的信息安全直辖市管理体系。研究制定粮食系统信息与网络安全管理和技术措施，加强对基础信息网络和管理住处系统的安全保护和监督管理。确保必要的安全设施投入，定期对信息网络进行安全保密性能综合测试与评估，充分利用加密，集中控制等技术手段，切实加强安全防范体系建设。三、总体架构根据“×××××粮食储备库”工程的建设目标和建设内容，基于SOA规范，采用云服务的理念和云计算的技术，将系统总体架构设计如下图所示：3.1系统基础平台满足系统稳定、高效、安全运行所需要的：1.基础网络：基于省政务内网资源，建设完成覆盖省、骨干库点的政务内网； 2.基础设施：数据中心机房建设所需的动力配电系统、空调新风系统、消防报警系统、弱电控制系统、机柜系统及防雷系统。3.网络设备：网络路由、安全、监控等设备。4.物联设备：向粮库、安防设施等提供实时监测所需的监控设备和感知设备。5.存储设备：提供海量数据存储和备份等设备。6.运维系统：对系统网络状况、硬件设备运行和软件运行进行实时监测，保证系统稳定高效运行。7.系统软件：操作系统、GIS中间件、应用中间件、数据库平台等。3.2粮库数据中心粮库管理数据中心建设集中式和分布式结合的数据中心，管理中心负责管理全省的粮库相关数据资源，并负责进行统一维护。3.3应用支撑平台应用支撑平台主要包括地理信息平台、共享服务平台、协同应用平台、内容管理平台、数据挖掘平台以及应用集成平台。应用支撑平台起到“承下启上”的作用，“承下”是指其基于数据中心，提供数据关联、处理和转换等服务，“启上”是指其为上层应用系统提供数据整合和共享、公共组件访问、统一用户权限、统一内容管理、统一地理空间以及数据挖掘分析等服务。此外，应用支撑平台也为系统与外部系统、外部资源提供交换和集成服务。3.4业务平台主要包括粮库环境监控平台、集成监管监控平台、智慧仓储安防平台。3.4.1粮库环境监控平台将省内的所以粮仓通过统一的监管平台进行统一监测，以起到统一管理、统一监控的一站总部式管理。3.4.2集成监管监控平台标准规范建设对本项目的顺利实施起着先导作用，本工程涉及到粮库数据采集、数据仓库建设、应用平台建设、安全体系建设、管理和运维体系建设，这些建设内容均需要标准规范的支撑，据此拟建立四大标准体系：数据规范、体系规范、接口规范、运管办法，在工程建设初期，数据规范是重点完成的体系。起到总监总控总管的作用。3.4.3智慧仓储智慧安防平台1.粮食流通管理数据中心整体维护计划的制定、执行、监督检查、更新完善。2.粮食流通管理数据中心维护团队建设，包括管理中心的人员职责、专业人才培养、各类技术支持公司的服务外包和及其服务职责。3.粮食流通管理数据动态更新的法律法规保障，技术层面的数据共享服务制度。4.预警应急事故的应急处置预案的建立。5.数据备份容灾制度、数据安全保密制度及责任追究等制度。6.粮食流通数据管理中心其他日常管理规章制度。3.5信息安全体系信息安全体系从物理层安全、网络层安全、系统层安全、应用层安全和制度层安全等方面为整个系统的安全提供保障。物理层：监控设备、消防安全设备、安防设备、防雷系统、中心机房空调设备等。网络层：基于政务内网与公众网络的物理隔离；网络防火墙、入侵检测设备和网络运行监控系统等。系统层：系统软件的定期安全补丁更新；系统管理员、数据库管理员强密码认证和定期更新制度保障。数据层：数据双机热备；数据备份策略，根据不同数据的安全要求，制定每天、每周、每月的定时备份计划；定期刻盘或异地容灾备份。应用层：身份认证：按保密局要求的强密码要求进行建设；授权体系：应用功能、数据访问范围等；管理模式：管理员、审核员、安全监督员三重管理模式；日志审计：用户登录、数据浏览、下载、编辑、删除、应用程序访问、数据交换等；数据传输：B/S程序采用https方式传输，C/S程序在不影响性能的前提下，加密传输。管理层：包括各项目管理制度，如安全管理规范、安全技术标准和安全运行标准等。

I. Construction Objectives
Closely align with the development requirements of modern grain depot management and the "13th Five-Year Development Plan for the Western Grain Reserve Depot Industry", and deepen the application of information technology in all links of grain depot intelligence and security monitoring. By 2016, initially establish the basic framework of "Smart Grain" marked by advanced information infrastructure, fully developed information resources, and rapid development of technological applications, with digital government affairs, precise business operations, networked services, and intelligent and smart governance as its core contents. Form a relatively complete grain depot information management platform with complete structure, comprehensive functions, safety and stability, information sharing, multi-level linkage, and full coverage of the province, comprehensively improve the level of information resource sharing, development and utilization, and social services, greatly enhance the ability to support scientific decision-making for grain macro-control and the transformation and upgrading of industrial development, and bring the province's grain informatization level to the forefront nationwide.

II. Construction Contents
Further promote the construction of smart grain depots, build a province-wide unified comprehensive information infrastructure and grain depot management data center, and realize centralized information, unified monitoring, and unified command for all grain depots in the province; Form two systems, namely the informatization standard system and the information security system. The main contents include:
1. Comprehensive Information Infrastructure Construction. Make full use of the government intranet resources of the provincial government, and complete the construction of a vertical network covering the provincial and depot levels. Meanwhile, the provincial and depot levels shall respectively improve their internal office local area networks, forming an information network for the Western Grain Reserve Depot where the vertical network and hierarchical local area networks are interconnected horizontally.
2. Grain Management Data Center Construction. Develop and improve the main business management systems with unified data interfaces, integrate various types of business data and information resources, focus on constructing a group of basic grain information resource databases such as the grain depot geographic information database and grain depot basic database, and gradually improve and form a provincial grain management data storage, processing, analysis and service center, and establish a provincial-level center based on management authority. On this basis, build a provincial-scale grain depot basic data dynamic monitoring system with "GIS (Geographic Information System)" application as the core, construct systems for grain emergency command, macro-control, early warning and forecasting, decision support, etc., so that information resources can be deeply explored and widely utilized, and information products will become increasingly abundant.
3. Business Management Informatization Construction. Construct an integrated unified platform for grain government affairs management and grain business management with business collaboration and multi-level linkage. Under this platform, develop and improve the main business management systems with unified data interfaces according to business categories, and comprehensively improve the capabilities of administrative efficiency, circulation supervision and macro-control support. Support and encourage the pilot and promotion of informatization technology projects such as the informatization systems of warehouse enterprises' grain depots (including grain condition monitoring systems), Internet of Things (IoT) perception technologies, and full-process automatic control of processing enterprises.
4. Informatization Standard System Construction. Combined with system development, study and formulate technical standards for information networks and hardware equipment, basic standards for data source collection of grain industry information, information classification and coding data standards, information technology application standards and information security technical standards step by step, and gradually form the grain informatization standard system, promote resource sharing, encourage pilot practices, and improve the overall development and utilization efficiency of information resources.
5. Information Security System Construction. While realizing resource sharing and development and utilization, ensure the safe operation of networks and information. Establish a leadership mechanism for information network security supervision, and form a province-wide unified information security coordinated management system. Study and formulate management and technical measures for information and network security of grain systems, and strengthen the security protection and supervision of basic information networks and management information systems. Ensure necessary investment in security facilities, conduct comprehensive tests and evaluations of the security and confidentiality performance of information networks on a regular basis, and make full use of technical means such as encryption and centralized control to effectively strengthen the construction of the security prevention system.

III. Overall Architecture
Based on the construction objectives and contents of the "××××× Grain Reserve Depot" project, and following the SOA (Service-Oriented Architecture) specifications, adopt the concept of cloud services and cloud computing technologies, the overall system architecture is designed as shown in the following figure:
3.1 System Basic Platform
To meet the requirements for stable, efficient and safe operation of the system:
1. Basic Network: Based on the provincial government intranet resources, construct a government intranet covering the provincial and key depot sites;
2. Infrastructure: Power distribution system, air conditioning and fresh air system, fire alarm system, weak current control system, cabinet system and lightning protection system required for the construction of the data center computer room.
3. Network Equipment: Network routing, security, monitoring and other equipment.
4. IoT Equipment: Monitoring equipment and perception equipment required for real-time monitoring of grain depots and security facilities.
5. Storage Equipment: Equipment for massive data storage and backup.
6. Operation and Maintenance System: Monitor the system network status, hardware equipment operation and software operation in real time to ensure stable and efficient operation of the system.
7. System Software: Operating system, GIS middleware, application middleware, database platform, etc.

3.2 Grain Depot Data Center
The grain depot management data center shall be constructed as a data center combining centralized and distributed architectures. The management center is responsible for managing the grain depot-related data resources across the province and conducting unified maintenance.

3.3 Application Support Platform
The application support platform mainly includes a geographic information platform, shared service platform, collaborative application platform, content management platform, data mining platform and application integration platform. The application support platform plays a role of "connecting the lower layers and supporting the upper layers": "connecting the lower layers" means that it is based on the data center and provides services such as data association, processing and conversion; "supporting the upper layers" means that it provides services such as data integration and sharing, public component access, unified user permissions, unified content management, unified geospatial and data mining analysis for upper-layer application systems. In addition, the application support platform also provides exchange and integration services between the system and external systems and external resources.

3.4 Business Platform
Mainly includes the grain depot environment monitoring platform, integrated supervision and monitoring platform, and smart warehouse security platform.
3.4.1 Grain Depot Environment Monitoring Platform
Unify and monitor all grain silos in the province through a unified supervision platform, so as to realize one-stop headquarters-style management with unified management and unified monitoring.
3.4.2 Integrated Supervision and Monitoring Platform
The construction of standards and specifications plays a leading role in the smooth implementation of this project. This project involves grain depot data collection, data warehouse construction, application platform construction, security system construction, management and operation and maintenance system construction, all of which require the support of standards and specifications. Therefore, it is planned to establish four major standard systems: data specifications, system specifications, interface specifications, and operation and management measures. In the initial stage of project construction, data specifications are the key system to be completed. It plays the role of overall supervision, unified control and overall management.
3.4.3 Smart Warehouse Security Platform
1. Formulation, implementation, supervision and inspection, update and improvement of the overall maintenance plan for the grain circulation management data center.
2. Construction of the maintenance team for the grain circulation management data center, including the personnel responsibilities of the management center, professional talent training, service outsourcing of various technical support companies and their service responsibilities.
3. Legal and regulatory guarantees for dynamic update of grain circulation management data, and technical-level data sharing service systems.
4. Establishment of emergency response plans for early warning and emergency accidents.
5. Systems such as data backup and disaster recovery system, data security and confidentiality system and responsibility investigation system.
6. Other daily management rules and regulations of the grain circulation data management center.

3.5 Information Security System
The information security system provides security guarantees for the entire system from the aspects of physical layer security, network layer security, system layer security, application layer security and management layer security.
Physical Layer: Monitoring equipment, fire safety equipment, security equipment, lightning protection system, central computer room air conditioning equipment, etc.
Network Layer: Physical isolation between the government intranet and public networks; network firewalls, intrusion detection equipment and network operation monitoring systems, etc.
System Layer: Regular security patch updates for system software; guarantee of strong password authentication and regular update systems for system administrators and database administrators.
Data Layer: Dual-machine hot backup for data; data backup strategies, formulate daily, weekly and monthly regular backup plans according to the security requirements of different data; regular disk burning or off-site disaster recovery backup.
Application Layer: Identity authentication: constructed in accordance with the strong password requirements of the State Secrets Administration; Authorization system: application functions, data access scope, etc.; Management mode: triple management mode of administrator, reviewer and security supervisor; Log audit: user login, data browsing, downloading, editing, deleting, application program access, data exchange, etc.; Data transmission: transmitted via HTTPS for Browser/Server (B/S) programs, and encrypted transmission for Client/Server (C/S) programs without affecting performance.
Management Layer: Includes various project management systems, such as security management specifications, security technical standards and security operation standards, etc.