Nuclear reactor business process system and design method based on complex authority fusion

Abstract

The present invention specifically relates to a nuclear reactor business process system based on complex authority fusion, including a platform business module, a security computing module and a platform data management module; the platform business module is bidirectionally data-connected with the security computing module and the platform data management module respectively, and the platform business module is used to execute business processes; the security computing module is used to carry out complex authority security judgments during the execution of business processes by the platform business module; the platform data management module is used to provide data storage and access services for the platform business module and the security computing module. The nuclear reactor business process system provided by the present invention improves the problem that the traditional workflow system can only realize the task information authority in the basic user-role relationship management workflow, and adopts the method of complex authority fusion to provide a complete security guarantee function for the business process.

Description

Technical Field

[0001] The present invention relates to the field of nuclear reactors, and in particular to a nuclear reactor business process system and a design method based on complex authority fusion. Background Art

[0002] The nuclear reactor R&D process is a typical multi-disciplinary, multi-professional, multi-technical, and highly coordinated complex system engineering R&D process, and needs to meet the needs of various types of projects such as military and civilian. The reactor project process needs to achieve refined management, transparent R&D processes, and precise relationships between things, so as to greatly improve research efficiency, ensure the quality of the R&D process is controlled, and comprehensively improve the level of R&D delivery. At present, in the field of nuclear reactor design and development, there is no digital reactor design platform suitable for R&D personnel, and there is a lack of online design methods for nuclear reactor business. Summary of the invention

[0003] Based on this, it is necessary to provide a nuclear reactor R&D process system based on complex authority fusion to address the problem of lack of digital reactor design platform suitable for R&D personnel. The nuclear reactor R&D process system performs fine-grained control over the entire R&D process based on the process technology of complex authority fusion, improves the standardization and standardization of R&D by making the R&D process explicit, and improves the problem of traditional workflow systems that can only realize basic user and group (role) relationship management in workflows based on the need for multi-dimensional task information security control at the authority encryption level in the field of nuclear reactor R&D. The complex authority fusion method is adopted to provide complete security protection functions for business processes.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] A nuclear reactor business process system based on complex authority fusion, comprising a platform business module, a security computing module and a platform data management module; the platform business module is bidirectionally data-connected with the security computing module and the platform data management module respectively, and the platform business module is used to execute business processes; the security computing module is used to carry out complex authority security judgments during the execution of business processes by the platform business module; the platform data management module is used to provide data storage and access services for the platform business module and the security computing module.

[0006] Furthermore, the nuclear reactor business process system based on complex authority fusion also includes an authority module and a confidentiality module, and the authority module and the confidentiality module are bidirectionally connected with the security calculation module and the platform data management module respectively; the authority module is used to provide the user's authority information in the process of complex authority security judgment carried out by the security calculation module; the confidentiality module is used to provide access services for complex authority intensive mapping information in the process of complex authority security judgment carried out by the security calculation module; the platform data management module is also used to provide data storage and access services for the authority module and the confidentiality module. Further, the business process includes issuing a business request, judging whether the current business request needs to access the process data required by the current business; if the current business request does not need to access the process data required by the current business, the execution of the business process is terminated; if the current business request needs to access the process data required by the current business, it is judged whether the authority and confidentiality of the current user allow access to the process data required by the current business; if the authority and confidentiality of the current user do not allow access to the process data required by the current business, the execution of the business process is terminated; if the authority and confidentiality of the current user both allow access to the current business, the business process is executed, and the current user is allowed to access the process data required by the current business. Further, the user selects a service request on the platform service module to trigger the platform service module to determine whether the current service request needs to access the process data required by the current service;

[0007] If the current business request does not need to access the process data required by the current business, the platform business module ends the execution of the business process; if the current business request needs to access the process data required by the current business, the platform business module parses the current user's identity and the process data identifier required by the current business from the current business request information and sends them to the security computing module;

[0008] The security computing module receives the identity of the current user and the process data identifier required for the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows access to the process data required for the current business;

[0009] If the current user's authority does not allow access to the process data required for the current business, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process; if the current user's authority allows access to the process data required for the current business, the security calculation module obtains the complex authority intensive mapping information of the current user through the access confidentiality module, and determines whether the current user's confidentiality level allows access to the process data required for the current business;

[0010] If the current user's confidentiality level does not allow access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module, and the platform business module will end the execution of the business process; if the current user's confidentiality level allows access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module; the platform business module executes the business process and allows the current user to access the process data required for the current business.

[0011] Furthermore, the business process also includes determining whether the process data required by the current business request contains process template information; if the process data required by the current business request does not contain process template information, terminating the execution of the business process; if the process data required by the current business request contains process template information, executing the business process, defining the process template, and instantiating the defined process template.

[0012] Furthermore, the nuclear reactor business process system based on complex authority fusion also includes a process template management module and a process instance module; the process template management module is bidirectionally data-connected with the platform business module and the security computing module respectively, and the process instance module is bidirectionally data-connected with the process template management module and the security computing module respectively; the process template management module is used to provide flexible process definition and process version management during the execution of business processes by the platform business module; the process instance module is used to provide instantiation and full life cycle management of defined process templates; the platform data management module is also used to provide data storage and access services for the process template management module and the process instance module.

[0013] Furthermore, the platform business module executes the business process, and when allowing the current user to access the process data required for the current business, determines whether the process data required for the current business request contains process template information;

[0014] If the process data required by the current business request does not contain the process template information, the platform business module ends the execution of the business process; if the process data required by the current business request contains the process template information, the platform business module sends the process template information required by the current business request to the process template management module;

[0015] The process template management module receives the process template information required for the current business request sent by the platform business module, defines the process template required for the current business request based on Activiti, and sends the defined process template information required for the current business request to the process instance module;

[0016] The process instance module receives the process template information required for the defined current business request sent by the process template management module, instantiates the process template required for the defined current business request, and the platform business process ends the execution of the business process.

[0017] Furthermore, in the process of defining the process template required for the current business request based on Activiti, the process template management module extends the service module of Activiti, intercepts the access interface of the service module of Activiti, and performs corresponding security calculations on each node of the Activiti process through the security calculation module.

[0018] Furthermore, the node information of the Activiti process flow is sent to the security calculation module; the security calculation module receives the node information of the Activiti process flow, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows access to the node information of the Activiti process flow;

[0019] If the current user's authority does not allow access to the node information of the Activiti process flow, the security calculation module sends the judgment result to the process template management module, and the process template management module ends the definition of the process template required for the current business request; if the current user's authority allows access to the node information of the Activiti process flow, the security calculation module obtains the complex authority intensive mapping information of the current user through the access confidentiality module, and determines whether the current user's confidentiality level allows access to the node information of the Activiti process flow;

[0020] If the current user's confidentiality level does not allow access to the node information of the Activiti process flow, the security calculation module will send the judgment result to the process template management module, and the process template management module will end the definition of the process template required for the current business request; if the current user's confidentiality level allows access to the node information of the Activiti process flow, the security calculation module will send the judgment result to the process template management module; the process template management module allows the current user to access the node information of the Activiti process flow; repeat the above operations until each node information of the Activiti process flow has passed the security judgment operation of the security calculation module, and the definition of the process template required for the current business request is completed.

[0021] Furthermore, the platform business module is composed of a collection of business units, and business requests are set on the business units; the security calculation module includes a permission calculation unit and a confidentiality matching calculation unit; the permission module includes a user, role data access unit, a permission data access unit, and a resource data access unit; the confidentiality module includes a confidentiality mapping unit, a data confidentiality query unit, and a personnel confidentiality query unit; the process template management module includes a process classification unit, a process version logic unit, and an Activiti mounting unit; the process instance module includes a process task unit, a process deliverable management unit, a process business data management unit, and a process flow management unit;

[0022] The user selects a business request on the business unit to trigger the corresponding business unit to determine whether the current business request needs to access the process data required by the current business;

[0023] If the current business request does not need to access the process data required by the current business, the business unit ends the execution of the business process; if the current business request needs to access the process data required by the current business, the business unit parses the current user's identity and the process data identifier required by the current business from the current business request information and sends them to the authority calculation unit and the confidentiality matching calculation unit;

[0024] The authority calculation unit receives the identity of the current user and the process data identifier required for the current business sent by the business unit, obtains all roles owned by the user through the access user and role data access unit according to the identity of the current user, and then sequentially queries the permissions corresponding to all roles returned in the previous step through the access permission data access unit, thereby querying and obtaining the permission information of the current user, and then judging whether the permissions of the current user allow access to the process data required for the current business by accessing the resource data;

[0025] If the current user's authority does not allow access to the process data required for the current business, the authority calculation unit sends the judgment result to the business unit, and the business unit ends the execution of the business process; if the current user's authority allows access to the process data required for the current business, the authority calculation unit sends the judgment result to the confidentiality matching calculation unit;

[0026] The confidentiality level matching calculation unit receives the identity identifier of the current user and the process data identifier required for the current business sent by the business unit, obtains the confidentiality level information of the current user through the access personnel confidentiality query unit according to the identity identifier of the current user, and then obtains the confidentiality level information of the process data required for the current business through the access data confidentiality query unit according to the process data identifier required for the current business, and finally calculates whether the confidentiality level information of the current user and the confidentiality level information of the process data required for the current business have corresponding matching mappings through the access confidentiality mapping unit, thereby obtaining the complex permission intensive mapping information of the current user, and judging whether the confidentiality level of the current user allows access to the process data required for the current business;

[0027] If the current user's confidentiality level does not allow access to the process data required for the current business, the confidentiality level matching calculation will send the judgment result to the business unit, and the business unit will end the execution of the business process; if the current user's confidentiality level allows access to the process data required for the current business, the confidentiality level matching calculation will send the judgment result to the business unit; the business unit executes the business process, allows the current user to access the process data required for the current business, and determines whether the process data required for the current business request contains process template information;

[0028] If the process data required by the current business request does not include process template information, the business unit ends the execution of the business process; if the process data required by the current business request includes process template information, the business unit sends the process template information required by the current business request to the process template management module;

[0029] The process template management module receives the process template information required for the current business request sent by the business unit, finds the process template required for the current business request through the process classification unit, defines the current business attributes through the process version logic unit, mounts the business attributes and form data to the Activiti process through the Activiti mounting unit, completes the definition of the process template required for the current business request, and sends the defined process template information required for the current business request to the process instance module;

[0030] The process instance module receives the process template information required for the current business request defined based on Activiti and sent by the process template management module, creates a process task through the process task unit, mounts the deliverable through the process deliverable management unit, assigns process data to the process node through the process business data management unit, determines the process direction through the process flow management unit, ensures the smooth and correct flow of the process, completes the instantiation of the process template required for the defined current business request, and the business unit ends the execution of the business process.

[0031] Furthermore, the business process also includes, if it is necessary to operate the current business data and / or deliverables during the execution of the business process, determining whether the current user's authority and confidentiality level allow the operation of the current business data and / or deliverables; if the current user's authority and confidentiality level do not allow the operation of the current business data and / or deliverables, terminating the execution of the business process; if the current user's authority and confidentiality level both allow the operation of the current business data and / or deliverables, executing the business process, allowing the current user to operate the current business data and / or deliverables, the current user operates the current business data and / or deliverables, and terminating the execution of the business process.

[0032] Furthermore, if the current business data and / or deliverables need to be operated during the execution of the business process, the platform business module parses the current business request information to obtain the operation data identifier and / or delivery service identifier of the current business and sends it to the secure computing module;

[0033] The security calculation module receives the operation data identifier and / or delivery service identifier of the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows the operation of the current business data and / or the deliverable; if the permission of the current user does not allow the operation of the current business data and / or the deliverable, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0034] If the current user's authority allows the operation of the current business data and / or deliverables, the security calculation module obtains the complex authority intensive mapping information of the current user by accessing the confidentiality level module, and determines whether the current user's confidentiality level allows the operation of the current business data and / or deliverables;

[0035] If the current user's confidentiality level does not allow operation of current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0036] If the current user's confidentiality level allows operations on current business data and / or deliverables, the security computing module sends the judgment result to the platform business module; the platform business module executes the business process, allowing the current user to operate the current business data and / or delivery, the user performs operations on the current business data and / or delivery, and the platform business module ends the execution of the business process.

[0037] The present invention also provides a method for designing a nuclear reactor business process system based on complex authority fusion, using the above-mentioned nuclear reactor business process system based on complex authority fusion, comprising the following steps:

[0038] S1: The user sends a business request, and the platform business module determines whether the current business request needs to access the process data required by the current business; if the current business request does not need to access the process data required by the current business, the platform business module ends the execution of the business process; if the current business request needs to access the process data required by the current business, the platform business module parses the current user's identity and the process data identifier required by the current business from the current business request information and sends it to the security computing module;

[0039] S2: The security computing module receives the identity identifier of the current user and the process data identifier required for the current business sent by the platform business module, and determines whether the current user's authority and confidentiality level allow access to the process data required for the current business; if the current user's authority or confidentiality level does not allow access to the process data required for the current business, the security computing module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process; if the current user's authority and confidentiality level both allow access to the process data required for the current business, the security computing module sends the judgment result to the platform business module, and the platform business module allows the current user to access the process data required for the current business, obtain the process data entity required for the current business, and execute the current business process.

[0040] Beneficial technical effects of the present invention:

[0041] The nuclear reactor business process system and design method based on complex authority fusion of the present invention have changed the traditional nuclear reactor design mode that relies on manual calculation and transmission of single interaction, integrated the nuclear reactor design process, quality management process, and confidentiality and security authority control, and built a research and development process integration system that meets the nuclear reactor design requirements. It realizes the transformation of the nuclear reactor design mode from offline design to online design, the matching of authority levels with research and development process nodes, and the transformation of the design process from inefficient serial to efficient parallel, ultimately achieving the effect of improving the quality of nuclear reactor design, shortening the nuclear reactor research and development cycle, and ensuring the control of the nuclear reactor research and development process. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the structure of a nuclear reactor business process system based on complex authority fusion according to the present invention;

[0043] Figure 2 Design a flow chart for the nuclear reactor business process system based on complex authority fusion of the present invention;

[0044] Figure 3 Provide permission calculation flow chart for permission module;

[0045] Figure 4 Flowchart for the confidentiality verification of the confidentiality module. DETAILED DESCRIPTION

[0046] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0047] See also Figure 1 The present invention provides a nuclear reactor business process system based on complex authority fusion, with platform business module, security calculation module, authority module, confidentiality module, process template management module, process instance module, and platform data management module as basic architecture support, using authority and confidentiality combined calculation, and integrating Activiti with each module, based on Activiti for security calculation expansion, strengthening the security auxiliary function of Activiti process, and building a nuclear reactor R&D process system with confidentiality fusion.

[0048] The nuclear reactor business process system based on complex authority fusion includes a platform business module, a security calculation module, a authority module, a confidentiality module, a process template management module, a process instance module and a platform data management module;

[0049] The platform business module is bidirectionally data-connected with the security calculation module, the process template management module and the platform data management module respectively, the process template management module is bidirectionally data-connected with the process instance module respectively, the security calculation module is bidirectionally data-connected with the authority module, the confidentiality module, the process template management module and the process instance module respectively, and the authority module and the confidentiality module are bidirectionally data-connected with the platform data management module respectively;

[0050] The platform business module is used to execute business processes; the security calculation module is used to carry out complex authority security judgments during the platform business module's execution of business processes; the authority module and confidentiality module are used to provide access services to user authority information and complex authority intensive mapping information during the security calculation module's complex authority security judgment process;

[0051] The process template management module is used to provide flexible process definition and process version management during the execution of business processes by the platform business module; the process instance module is used to provide instantiation and full life cycle management of defined process templates; the platform data management module is used to provide data storage and access services for the operation of the platform business module, security computing module, authority module, confidentiality module, process template management module, and process instance module.

[0052] Furthermore, the business process includes issuing a business request, determining whether the current business request needs to access process data required by the current business; if the current business request does not need to access process data required by the current business, terminating the execution of the business process; if the current business request needs to access process data required by the current business, determining whether the authority and confidentiality level of the current user allow access to the process data required by the current business;

[0053] If the current user's authority and confidentiality level do not allow access to the process data required for the current business, the business process ends; if the current user's authority and confidentiality level both allow access to the current business, the business process is executed, allowing the current user to access the process data required for the current business, and determining whether the process data required for the current business request contains process template information;

[0054] If the process data required by the current business request does not contain process template information, the business process is terminated; if the process data required by the current business request contains process template information, the business process is executed, the process template is defined, and the defined process template is instantiated.

[0055] Further, the user selects a service request on the platform service module to trigger the platform service module to determine whether the current service request needs to access the process data required by the current service;

[0056] If the current business request does not need to access the process data required by the current business, the platform business module ends the execution of the business process; if the current business request needs to access the process data required by the current business, the platform business module parses the current user's identity and the process data identifier required by the current business from the current business request information and sends it to the security computing module;

[0057] The security computing module receives the identity of the current user and the process data identifier required for the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows access to the process data required for the current business;

[0058] If the current user's permissions do not allow access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module, and the platform business module will end the execution of the business process; if the current user's permissions allow access to the process data required for the current business, the security calculation module obtains the current user's complex permission intensive mapping information through the access confidentiality module to determine whether the current user's confidentiality level allows access to the process data required for the current business;

[0059] If the current user's confidentiality level does not allow access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module, and the platform business module will end the execution of the business process; if the current user's confidentiality level allows access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module; the platform business module executes the business process, allows the current user to access the process data required for the current business, and determines whether the process data required for the current business request contains process template information;

[0060] If the process data required by the current business request does not contain process template information, the platform business module ends the execution of the business process; if the process data required by the current business request contains process template information, the platform business module sends the process template information required by the current business request to the process template management module;

[0061] The process template management module receives the process template information required for the current business request sent by the platform business module, defines the process template required for the current business request based on Activiti, and sends the defined process template information required for the current business request to the process instance module;

[0062] The process instance module receives the process template information required for the defined current business request sent by the process template management module, instantiates the defined process template required for the current business request, and the platform business process ends the execution of the business process.

[0063] Furthermore, in the process of defining the process template required for the current business request based on Activiti, the process template management module extends the service module of Activiti, intercepts the access interface of the service module of Activiti, and performs corresponding security calculations on each node of the Activiti process through the security calculation module, so as to supplement the deficiencies of the security calculation of Activiti itself, which specifically includes the following steps:

[0064] The node information of the Activiti process flow is sent to the security calculation module. The security calculation module receives the node information of the Activiti process flow, obtains the permission information of the current user through the access permission module, and determines whether the current user's permission allows access to the node information of the Activiti process flow;

[0065] If the current user's permissions do not allow access to the node information of the Activiti process flow, the security calculation module will send the judgment result to the process template management module, and the process template management module will end the definition of the process template required for the current business request;

[0066] If the current user's permissions allow access to the node information of the Activiti process flow, the security calculation module obtains the complex permission intensive mapping information of the current user through the access confidentiality module to determine whether the current user's confidentiality level allows access to the node information of the Activiti process flow;

[0067] If the current user's confidentiality level does not allow access to the node information of the Activiti process flow, the security calculation module will send the judgment result to the process template management module, and the process template management module will end the definition of the process template required for the current business request;

[0068] If the current user's confidentiality level allows access to the node information of the Activiti process flow, the security calculation module will send the judgment result to the process template management module; the process template management module allows the current user to access the node information of the Activiti process flow;

[0069] Repeat the above steps until each node information of the Activiti process flow has been subjected to the security judgment calculation of the security calculation module, and the definition of the process template required for the current business request is completed.

[0070] Activiti's service modules include Repository Service and Task Service.

[0071] Repository Service is the warehouse service class of Acitiviti, which provides operations on process template files and access to the process template deployment repository. The files in the warehouse that define the process template include two files: bpmn file and process image. The specific functions of Repository Service include deployment, deletion, query of process templates, and parsing and verification of process template xml.

[0072] Task Service is a service class provided by Acitiviti to operate process task nodes. It provides functions such as accessing and modifying the information of process nodes, such as viewing the specific information of process nodes, modifying the name of process nodes, process node approvers, etc. It also includes the processing of process tasks, such as setting the task to the completed state and transferring the process flow to the next task node.

[0073] Further, the platform business module is composed of a collection of business units, the business units include project management units, knowledge engineering units and design file management units, on which business requests are set; business requests are set on the business units; the security calculation module includes an authority calculation unit and a confidentiality matching calculation unit; the authority module includes a user, role data access unit, an authority data access unit, and a resource data access unit; the confidentiality module includes a confidentiality mapping unit, a data confidentiality query unit, and a personnel confidentiality query unit; the process template management module includes a process classification unit, a process version logic unit and an Activiti mounting unit; the process instance module includes a process task unit, a process deliverable management unit, a process business data management unit and a process flow management unit;

[0074] The user selects a business request on the business unit to trigger the corresponding business unit to determine whether the current business request needs to access the process data required by the current business;

[0075] If the current business request does not need to access the process data required by the current business, the business unit ends the execution of the business process; if the current business request needs to access the process data required by the current business, the business unit parses the current user's identity and the process data identifier required by the current business from the current business request information and sends them to the authority calculation unit and the confidentiality matching calculation unit;

[0076] The permission calculation unit receives the identity of the current user and the process data identifier required for the current business sent by the business unit, obtains all roles owned by the user through the access user and role data access unit according to the identity of the current user, and then sequentially queries the permissions corresponding to all roles returned by the previous steps through the access permission data access unit, thereby querying and obtaining the permission information of the current user, and then judging whether the permission of the current user allows access to the process data required for the current business by accessing the resource data;

[0077] If the current user's authority does not allow access to the process data required for the current business, the authority calculation unit sends the judgment result to the business unit, and the business unit ends the execution of the business process; if the current user's authority allows access to the process data required for the current business, the authority calculation unit sends the judgment result to the confidentiality matching calculation unit;

[0078] The confidentiality level matching calculation unit receives the identity of the current user and the process data identifier required for the current business sent by the business unit, obtains the confidentiality information of the current user through the access personnel confidentiality query unit according to the identity of the current user, and then obtains the confidentiality information of the process data required for the current business through the access data confidentiality query unit according to the process data identifier required for the current business, and finally calculates whether the confidentiality information of the current user and the confidentiality information of the process data required for the current business have corresponding matching mappings through the access confidentiality mapping unit, thereby obtaining the complex permission intensive mapping information of the current user, and judging whether the confidentiality level of the current user allows access to the process data required for the current business;

[0079] If the current user's confidentiality level does not allow access to the process data required for the current business, the confidentiality level matching calculation will send the judgment result to the business unit, and the business unit will end the execution of the business process; if the current user's confidentiality level allows access to the process data required for the current business, the confidentiality level matching calculation will send the judgment result to the business unit; the business unit executes the business process, allows the current user to access the process data required for the current business, and determines whether the process data required for the current business request contains process template information based on the definition of the business request;

[0080] If the process data required by the current business request does not contain the process template information, the business unit ends the execution of the business process; if the process data required by the current business request contains the process template information, the business unit sends the process template information required by the current business request to the process template management module;

[0081] The process template management module receives the process template information required for the current business request sent by the business unit, finds the process template required for the current business request through the process classification unit, defines the current business attributes through the process version logic unit, mounts the business attributes and form data to the Activiti process through the Activiti mounting unit, completes the definition of the process template required for the current business request, and sends the defined process template information required for the current business request to the process instance module;

[0082] The process instance module receives the process template information required for the current business request defined based on Activiti sent by the process template management module, creates a process task through the process task unit, mounts the deliverable through the process deliverable management unit, assigns process data to the process node through the process business data management unit, determines the process direction through the process flow management unit, ensures the smooth and correct flow of the process, completes the instantiation of the process template required for the defined current business request, and the business unit ends the execution of the business process.

[0083] The business unit encapsulates a series of business request sets according to a specific business function that the unit needs to implement to implement the corresponding business function points. For example, when executing a design task in the project management business unit, it is necessary to query a certain technical document. At this time, a query request will be issued. During this process, the business initiator's identity, process data identification, request object, object owner identification, object entry and other information are included. If you need to download this document, a download request will be issued. During this process, the business initiator's identity, process data identification, request object, object owner identification, object destination identification and other information are included. Similarly, other business requests contain different request contents depending on the business purpose to be achieved in different scenarios.

[0084] Furthermore, the business process also includes, if it is necessary to operate the current business data and / or deliverables during the execution of the business process, determining whether the current user's authority and confidentiality level allow the operation of the current business data and / or deliverables; if the current user's authority and confidentiality level do not allow the operation of the current business data and / or deliverables, terminating the execution of the business process; if the current user's authority and confidentiality level both allow the operation of the current business data and / or deliverables, executing the business process, allowing the current user to operate the current business data and / or deliverables, and terminating the execution of the business process.

[0085] Furthermore, if the current business data and / or deliverables need to be operated during the execution of the business process, the platform business module parses the current business request information to obtain the operation data identifier and / or delivery service identifier of the current business and sends it to the secure computing module;

[0086] The security calculation module receives the operation data identifier and / or delivery service identifier of the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows the operation of the current business data and / or deliverables; if the permission of the current user does not allow the operation of the current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0087] If the current user's authority allows the operation of the current business data and / or deliverables, the security calculation module obtains the complex authority intensive mapping information of the current user by accessing the confidentiality level module, and determines whether the current user's confidentiality level allows the operation of the current business data and / or deliverables;

[0088] If the current user's confidentiality level does not allow operation of current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0089] If the current user's confidentiality level allows operations on current business data and / or deliverables, the security computing module will send the judgment result to the platform business module; the platform business module executes the business process, allowing the current user to operate the current business data and / or delivery, the user performs operations on the current business data and / or delivery, and the platform business module ends the execution of the business process.

[0090] See also Figure 2 The present invention also provides a nuclear reactor business process system design method based on complex authority fusion, comprising the following steps:

[0091] S1: The user sends a business request, and the platform business module determines whether the current business request needs to access the process data required by the current business; if the current business request does not need to access the process data required by the current business, the platform business module ends the execution of the business process; if the current business request needs to access the process data required by the current business, the platform business module parses the current user's identity and the process data identifier required by the current business from the current business request information and sends it to the security computing module;

[0092] S2: The security calculation module receives the identity of the current user and the process data identifier required for the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows access to the process data required for the current business; if the permission of the current user does not allow access to the process data required for the current business, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0093] If the current user's permissions allow access to the process data required for the current business, the security calculation module obtains the current user's complex permission intensive mapping information through the access confidentiality module to determine whether the current user's confidentiality level allows access to the process data required for the current business;

[0094] If the current user's confidentiality level does not allow access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module, and the platform business module will end the execution of the business process; if the current user's confidentiality level allows access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module; the platform business module allows the current user to access the process data required for the current business, obtain the process data entity required for the current business, and execute the current business process;

[0095] If the current business process execution requires the operation of current business data and / or deliverables, the platform business module parses the current business request information to obtain the operation data identifier and / or delivery service identifier of the current business and sends it to the security computing module;

[0096] The security calculation module receives the operation data identifier and / or delivery service identifier of the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows the operation of the current business data and / or deliverables; if the permission of the current user does not allow the operation of the current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0097] If the current user's authority allows the operation of the current business data and / or deliverables, the security calculation module obtains the complex authority intensive mapping information of the current user by accessing the confidentiality level module, and determines whether the current user's confidentiality level allows the operation of the current business data and / or deliverables;

[0098] If the current user's confidentiality level does not allow operation of current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process;

[0099] If the current user's confidentiality level allows operations on current business data and / or deliverables, the security computing module will send the judgment result to the platform business module; the platform business module allows the current user to operate the current business data and / or delivery, the user performs operations on the current business data and / or delivery, and the platform business module ends the execution of the business process.

[0100] See also Figure 3 , further, determining whether the current user's authority allows access to the process data required for the current business includes the following steps:

[0101] The permission calculation unit receives the identity of the current user and the process data identifier required for the current business sent by the business unit, and obtains all the roles owned by the user by accessing the user and role data access units according to the identity of the current user, and then queries the permissions corresponding to all the roles returned by the previous steps in turn through the access permission data access unit, thereby obtaining the permission information of the current user, and then determines whether the current user's permissions allow access to the process data required for the current business by accessing the resource data.

[0102] See also Figure 4 , further, determining whether the current user's confidentiality level allows access to the process data required for the current business, including the following steps:

[0103] The confidentiality level matching calculation unit receives the identity of the current user and the process data identifier required for the current business sent by the business unit, obtains the confidentiality information of the current user through the access personnel confidentiality query unit according to the identity of the current user, and then obtains the confidentiality information of the process data required for the current business through the access data confidentiality query unit according to the process data identifier required for the current business. Finally, the access confidentiality mapping unit calculates whether the confidentiality information of the current user and the confidentiality information of the process data required for the current business have corresponding matching mappings, thereby obtaining the complex permission intensive mapping information of the current user, and judging whether the confidentiality level of the current user allows access to the process data required for the current business.

[0104] Furthermore, the permission calculation unit and the confidentiality matching calculation unit both use AOP aspect programming to access data, intercept all Activiti methods for accessing data and insert corresponding permission and confidentiality verification before calling.

[0105] The nuclear reactor R&D process system and design method based on complex authority fusion of the present invention establishes a complex authority management system and integrates it into the traditional workflow engine based on Activiti, improves the processing means of the Activiti workflow regarding the authority logic, increases the authority control combining authority and confidentiality level, and makes the external authority confidentiality level system and the Activiti authority system complement each other to form a whole, so as to achieve the security control of nuclear reactor R&D data, the matching of authority confidentiality level and process, and the efficient online design management that meets the national requirements for nuclear reactor design.

[0106] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A nuclear reactor business process system based on complex authority fusion, characterized in that: It includes a platform business module, a security computing module and a platform data management module; the platform business module is bidirectionally connected with the security computing module and the platform data management module respectively, and the platform business module is used to execute business processes; the security computing module is used to carry out complex authority security judgments during the execution of business processes by the platform business module; The platform data management module is used to provide data storage and access services for the platform business module and the security computing module; The nuclear reactor business process system based on complex authority fusion also includes an authority module and a confidentiality module, and the authority module and the confidentiality module are bidirectionally data-connected with the security calculation module and the platform data management module respectively; the authority module is used to provide the user's authority information in the process of complex authority security judgment carried out by the security calculation module; the confidentiality module is used to provide access services for complex authority intensive mapping information in the process of complex authority security judgment carried out by the security calculation module; the platform data management module is also used to provide data storage and access services for the authority module and the confidentiality module; The business process includes issuing a business request and determining whether the current business request needs to access process data required by the current business; If the current business request does not need to access the process data required by the current business, the business process execution ends; If the current business request requires access to process data required by the current business, determine whether the current user's authority and confidentiality level allow access to the process data required by the current business; If the current user's authority and confidentiality level do not allow access to the process data required for the current business, the business process is terminated; If the current user's permissions and confidentiality level allow access to the current business, the business process is executed, allowing the current user to access the process data required for the current business; The business process also includes determining whether the process data required by the current business request contains process template information; if the process data required by the current business request does not contain process template information, terminating the execution of the business process; If the process data required by the current business request contains process template information, execute the business process, define the process template, and instantiate the defined process template; The nuclear reactor business process system based on complex authority fusion also includes a process template management module and a process instance module; The process template management module is bidirectionally connected to the platform business module and the security computing module respectively, and the process instance module is bidirectionally connected to the process template management module and the security computing module respectively; the process template management module is used to provide flexible process definition and process version management during the execution of business processes by the platform business module; the process instance module is used to provide instantiation and full life cycle management of defined process templates; the platform data management module is also used to provide data storage and access services for the process template management module and the process instance module; In the process of defining the process template required for the current business request based on Activiti, the process template management module intercepts the access interface of the Activiti service module by extending the Activiti service module, and performs corresponding security calculations on each node of the Activiti process through the security calculation module.

2. The nuclear reactor business process system based on complex authority fusion according to claim 1 is characterized in that: The user selects a business request on the platform business module to trigger the platform business module to determine whether the current business request needs to access the process data required by the current business; If the current business request does not need to access the process data required by the current business, the platform business module ends the execution of the business process; If the current business request needs to access the process data required by the current business, the platform business module parses the current user's identity and the process data identifier required by the current business from the current business request information and sends them to the security computing module; The security computing module receives the identity of the current user and the process data identifier required for the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows access to the process data required for the current business; If the current user's authority does not allow access to the process data required for the current business, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process; If the current user's authority allows access to the process data required for the current business, the security calculation module obtains the complex authority intensive mapping information of the current user through the access confidentiality module to determine whether the current user's confidentiality level allows access to the process data required for the current business; If the current user's confidentiality level does not allow access to the process data required for the current business, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process; If the current user's confidentiality level allows access to the process data required for the current business, the security calculation module sends the judgment result to the platform business module; The platform business module executes business processes and allows the current user to access process data required for the current business.

3. The nuclear reactor business process system based on complex authority fusion according to claim 1 is characterized in that: The platform business module executes the business process, allowing the current user to access the process data required for the current business, and determines whether the process data required for the current business request contains process template information; If the process data required by the current business request does not contain the process template information, the platform business module ends the execution of the business process; If the process data required by the current business request includes process template information, the platform business module sends the process template information required by the current business request to the process template management module; The process template management module receives the process template information required for the current business request sent by the platform business module, defines the process template required for the current business request based on Activiti, and sends the defined process template information required for the current business request to the process instance module; The process instance module receives the process template information required for the defined current business request sent by the process template management module, instantiates the process template required for the defined current business request, and the platform business process ends the execution of the business process.

4. The nuclear reactor business process system based on complex authority fusion according to claim 1 is characterized in that: The node information of the Activiti process flow is sent to the security calculation module; the security calculation module receives the node information of the Activiti process flow, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows access to the node information of the Activiti process flow; If the current user's permissions do not allow access to the node information of the Activiti process flow, the security calculation module sends the judgment result to the process template management module, and the process template management module ends the definition of the process template required for the current business request; If the current user's permissions allow access to the node information of the Activiti process flow, the security calculation module obtains the complex permission intensive mapping information of the current user through the access level module, and determines whether the current user's level allows access to the node information of the Activiti process flow; If the current user's confidentiality level does not allow access to the node information of the Activiti process flow, the security calculation module sends the judgment result to the process template management module, and the process template management module ends the definition of the process template required for the current business request; If the current user's confidentiality level allows access to the node information of the Activiti process flow, the security calculation module sends the judgment result to the process template management module; The process template management module allows the current user to access the node information of the Activiti process flow; repeat the above operation until each node information of the Activiti process flow has passed the security judgment operation of the security calculation module, and completes the definition of the process template required for the current business request.

5. The nuclear reactor business process system based on complex authority fusion according to claim 3 is characterized in that: The platform business module is composed of a collection of business units, and business requests are set on the business units; the security calculation module includes a permission calculation unit and a confidentiality matching calculation unit; the permission module includes a user, role data access unit, a permission data access unit, and a resource data access unit; the confidentiality module includes a confidentiality mapping unit, a data confidentiality query unit, and a personnel confidentiality query unit; the process template management module includes a process classification unit, a process version logic unit, and an Activiti mounting unit; the process instance module includes a process task unit, a process deliverable management unit, a process business data management unit, and a process flow management unit; The user selects a business request on the business unit to trigger the corresponding business unit to determine whether the current business request needs to access the process data required by the current business; If the current business request does not need to access the process data required by the current business, the business unit ends the execution of the business process; If the current business request needs to access the process data required by the current business, the business unit parses the current user's identity and the process data identifier required by the current business from the current business request information and sends them to the authority calculation unit and the confidentiality matching calculation unit; The authority calculation unit receives the identity of the current user and the process data identifier required for the current business sent by the business unit, obtains all roles owned by the user through the access user and role data access unit according to the identity of the current user, and then sequentially queries the permissions corresponding to all roles returned in the previous step through the access permission data access unit, thereby querying and obtaining the permission information of the current user, and then judging whether the permissions of the current user allow access to the process data required for the current business by accessing the resource data; If the current user's authority does not allow access to the process data required for the current business, the authority calculation unit sends the judgment result to the business unit, and the business unit ends the execution of the business process; If the current user's authority allows access to the process data required for the current business, the authority calculation unit sends the judgment result to the confidentiality level matching calculation unit; The confidentiality level matching calculation unit receives the identity identifier of the current user and the process data identifier required for the current business sent by the business unit, obtains the confidentiality level information of the current user through the access personnel confidentiality query unit according to the identity identifier of the current user, and then obtains the confidentiality level information of the process data required for the current business through the access data confidentiality query unit according to the process data identifier required for the current business, and finally calculates whether the confidentiality level information of the current user and the confidentiality level information of the process data required for the current business have corresponding matching mappings through the access confidentiality mapping unit, thereby obtaining the complex permission intensive mapping information of the current user, and judging whether the confidentiality level of the current user allows access to the process data required for the current business; If the current user's security level does not allow access to the process data required for the current business, the security level matching calculation sends the judgment result to the business unit, and the business unit ends the execution of the business process; If the current user's confidentiality level allows access to the process data required for the current business, the confidentiality level matching calculation sends the judgment result to the business unit; The business unit executes the business process, allows the current user to access the process data required for the current business, and determines whether the process data required for the current business request contains process template information; If the process data required by the current business request does not include the process template information, the business unit ends the execution of the business process; If the process data required by the current business request includes process template information, the business unit sends the process template information required by the current business request to the process template management module; The process template management module receives the process template information required for the current business request sent by the business unit, finds the process template required for the current business request through the process classification unit, defines the current business attributes through the process version logic unit, mounts the business attributes and form data to the Activiti process through the Activiti mounting unit, completes the definition of the process template required for the current business request, and sends the defined process template information required for the current business request to the process instance module; The process instance module receives the process template information required for the current business request defined based on Activiti and sent by the process template management module, creates a process task through the process task unit, mounts the deliverable through the process deliverable management unit, assigns process data to the process node through the process business data management unit, determines the process direction through the process flow management unit, ensures the smooth and correct flow of the process, completes the instantiation of the process template required for the defined current business request, and the business unit ends the execution of the business process.

6. The nuclear reactor business process system based on complex authority fusion according to claim 1 is characterized in that: The business process also includes, if the current business data and / or deliverables need to be operated during the execution of the business process, determining whether the authority and confidentiality level of the current user allow the operation of the current business data and / or deliverables; If the current user's authority and confidentiality level do not allow operation of current business data and / or deliverables, the business process is terminated; If the current user's permissions and confidentiality levels allow the operation of the current business data and / or deliverables, the business process is executed, the current user is allowed to operate the current business data and / or deliverables, the current user operates the current business data and / or deliverables, and the execution of the business process ends.

7. The nuclear reactor business process system based on complex authority fusion according to claim 6 is characterized in that: If the current business data and / or deliverables need to be operated during the execution of the business process, the platform business module parses the current business request information to obtain the operation data identifier and / or delivery service identifier of the current business and sends it to the secure computing module; The security calculation module receives the operation data identifier and / or delivery service identifier of the current business sent by the platform business module, obtains the permission information of the current user through the access permission module, and determines whether the permission of the current user allows the operation of the current business data and / or the deliverable; if the permission of the current user does not allow the operation of the current business data and / or the deliverable, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process; If the current user's authority allows the operation of the current business data and / or deliverables, the security calculation module obtains the complex authority intensive mapping information of the current user by accessing the confidentiality level module, and determines whether the current user's confidentiality level allows the operation of the current business data and / or deliverables; If the current user's confidentiality level does not allow operation of current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module, and the platform business module ends the execution of the business process; If the current user's confidentiality level allows the operation of current business data and / or deliverables, the security calculation module sends the judgment result to the platform business module; The platform business module executes the business process, allowing the current user to operate the current business data and / or delivery. The user performs the operation of the current business data and / or delivery, and the platform business module ends the execution of the business process.

8. A nuclear reactor business process method based on complex authority fusion, characterized in that: The nuclear reactor business process system based on complex authority fusion according to any one of claims 1 to 7 comprises the following steps: S1: The user sends a business request, and the platform business module determines whether the current business request needs to access the process data required by the current business; if the current business request does not need to access the process data required by the current business, the platform business module ends the execution of the business process; If the current business request needs to access the process data required by the current business, the platform business module parses the current business request information to obtain the identity of the current user and the process data identifier required by the current business and sends it to the security computing module; S2: The security computing module receives the identity of the current user and the process data identifier required for the current business sent by the platform business module, and determines whether the authority and confidentiality level of the current user allow access to the process data required for the current business; If the current user's authority or confidentiality level does not allow access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module, and the platform business module will end the execution of the business process; If the current user's permissions and confidentiality levels allow access to the process data required for the current business, the security calculation module will send the judgment result to the platform business module. The platform business module allows the current user to access the process data required for the current business, obtain the process data entity required for the current business, and execute the current business process.

Images