Security management server, process automation client and process automation system

Abstract

The invention discloses a security management server, a process automation client and a process automation system. Wherein the security management server is applied to a server and comprises an identity authentication module and an authority control module; the identity authentication module is used for receiving account authentication information from the process automation client and determining authority information of the process automation client; the permission control module is used for responding to application information for the static service function file sent by the process automation client, determining whether the process automation client has application permission for applying for the static service function file or not based on the permission information, and sending the application permission to the process automation client when the process automation client has the application permission. Sending a pre-stored static business function file to the process automation client; wherein the static service function file is used for enabling the process automation client to execute robot process automation operation corresponding to the static service function file. According to the method, the safety of executing the robot process automation operation can be enhanced.

Description

Technical Field

[0001] The present invention relates to the field of robot process automation technology, and in particular to a security management server, a process automation client and a process automation system. Background Art

[0002] With the rapid development of information technology, more and more information automation technologies have been gradually integrated into the business processing of various enterprises and institutions. Among them, robotic process automation technology is a major aspect of information automation technology. At present, the development of robotic process automation technology has been very mature. Many systems can formulate the behavior rules of the robotic process automation executor in the client in a targeted manner. Through the robotic process automation executor, the computer is constantly clicked by the mouse, the keyboard is tapped, and data is processed to realize the automation of business processes.

[0003] However, for system-level security management, especially for information systems with high data control requirements, security issues and privacy security control in the process of operating internal data of each system must be considered when constructing robotic process automation. However, due to the characteristics of robotic process automation technology, it automatically performs related business operations, which may involve risks such as information leakage when performing robotic process automation operations, resulting in low security during existing robotic process automation operations. Summary of the invention

[0004] In view of this, the present application provides a security management server, a process automation client and a process automation system, the main purpose of which is to solve the technical problem of low security in existing robotic process automation operations.

[0005] According to a first aspect of the present invention, there is provided a security management server, which is applied to a server, and the security management server includes an identity authentication module and a permission control module;

[0006] The identity authentication module is used to receive account authentication information from the process automation client, determine whether the process automation client has the authority to log in to the security management server based on the account authentication information, and determine the authority information of the process automation client based on the account authentication information when the process automation client has the authority to log in to the security management server;

[0007] The authority control module is used to receive application information for a static business function file sent by the process automation client, determine whether the process automation client has application authority for the static business function file based on the authority information, and send the pre-stored static business function file to the process automation client when the process automation client has the application authority;

[0008] The static business function file is used to enable the robotic process automation executor provided at the process automation client to perform the robotic process automation operation corresponding to the static business function file.

[0009] In an optional embodiment, the security management server also includes a security management module and an application management module; the application management module is used to obtain the static business function file, and store and manage the static business function file; the security management module is used to obtain the log information generated when the robotic process automation executor executes the robotic process automation operation based on the static business function file, and determine whether an execution exception occurs when the robotic process automation executor executes the robotic process automation operation based on the log information.

[0010] In an optional embodiment, the application management module includes an application interface submodule; the application interface submodule is used to access an external system to establish data interaction between the security management server and the external system.

[0011] In an optional embodiment, the application management module also includes a configuration management submodule and a source verification submodule; the configuration management submodule is used to respond to the configuration operation of the configuration management submodule to obtain the static business function file; the source verification submodule is used to perform a security check on the static business function file received from the external system, and when the static business function file passes the security check, store the static business function file in the application management module.

[0012] In an optional embodiment, the source verification submodule performs security verification on the static business function file in the following manner: the source verification submodule obtains the identity information of the external system that is the source of the static business function file, and compares the identity information with a plurality of pre-stored trusted identity information to determine whether the identity information is the same as one of the plurality of trusted identity information; when the identity information is the same as one of the plurality of trusted identity information, it is determined that the static business function file has passed the security verification.

[0013] In an optional embodiment, the application management module also includes an executor management submodule; the executor management submodule is used to determine the working status of the robotic process automation executor, and to control the robotic process automation executor to stop executing the robotic process automation operation and control the process automation client to log out of the robotic process automation executor.

[0014] In an optional embodiment, the permission control module determines whether the process automation client has the application permission for the static business function file based on the permission information, including: the permission control module sends the identification information of the static business function file applied for by the process automation client and the permission information of the process automation client to a remote host computer; and in response to the permission authentication instruction sent by the host computer, sends the static business function file to the process automation client.

[0015] In an optional embodiment, the security management server also includes a business audit module; the business audit module is used to obtain the operation records of the process automation client when executing the robotic process automation operation and the log information generated when executing the robotic process automation operation, and send the operation records and the log information to a remote audit host computer.

[0016] According to a second aspect of the present invention, there is provided a process automation client for interacting with the security management server as described above, wherein the process automation client is configured to perform the following processing:

[0017] Sending account authentication information and application information for obtaining static business function files to the security management server;

[0018] Receive the static business function file sent by the security management server, and in response to an execution command for the static business function file, execute the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client.

[0019] In an optional embodiment, the manner in which the process automation client performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client includes: the process automation client obtains, from the security management server, the permission information of the process automation client determined by the security management server based on the account authentication information, and the permission requirement information corresponding to the static business function file; determines whether the permission information of the process automation client meets the permission requirement information; and when the permission information of the process automation client meets the permission requirement information, performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor.

[0020] In an optional embodiment, the method in which the process automation client performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client also includes: the process automation client sends static business function file status determination information containing identification information of the static business function file to the security management server, so that after receiving the static business function file status determination information, the security management server sends the status information of the static business function file to the process automation client, wherein the status information includes normal status information and static business function file cancellation information; receives the status information, and when the status information is the normal status information, performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor.

[0021] In an optional embodiment, the operation object on which the robotic process automation executor performs the robotic process automation operation is preset with permission condition information; the process automation client is also configured to perform the following processing: determine the permission condition information of the operation object on which the robotic process automation executor is to perform the robotic process automation operation; determine whether the permission information of the process automation client satisfies the permission condition information; if the permission information does not satisfy the permission condition information, then the robotic process automation operation is not performed on the operation object.

[0022] According to a third aspect of the present invention, a process automation system is provided, the process automation system comprising the security management server as described above, and the process automation client as described above.

[0023] The present invention provides a security management server, a process automation client, and a process automation system. First, the identity authentication module of the security management server obtains the account authentication information sent by the process automation client that executes the robot process automation operation to determine the authority information corresponding to the process automation client. Then, the authority control module of the security management server obtains the application information sent by the process automation client, wherein the application information includes the identification information of the static business function file required when the process automation client wants to perform the business operation. Here, the static business function file is the script file required for the robot process automation executor of the process automation client to perform the business operation, and the robot process automation executor can perform the above-mentioned business operation based on the script file. Here, the static business function file for executing the business operation can be pre-configured for each business operation. Further, the authority control module determines whether the process automation client has the authority to perform the business operation based on the static business function file applied by it. When the process automation client has the authority to perform the business operation based on the static business function file applied by it, the above-mentioned static business function file is sent to the process automation client, so that the process automation client can perform the robot process automation operation corresponding to the static business function file based on the static business function file to complete the corresponding business operation. Furthermore, when the process automation client does not have the authority to perform business operations based on the static business function file it has applied for, the above static business function file is not sent to the process automation client, so that the process automation client cannot perform the robotic process automation operation corresponding to the static business function file.

[0024] Furthermore, the process automation client can send account authentication information and application information for obtaining static business function files to the security management server. Furthermore, when the security management server determines based on the account authentication information that the process automation client has the authority to use the static business function files it has applied for, it sends the static business function files applied for by the application information to the process automation client. Furthermore, the process automation client executes the static business function files to automatically perform the business operations corresponding to the static business function files based on the robotic process automation technology. The technical solution provided by the present application can determine whether the process automation client has the authority to perform business operations based on the static business function files, and only sends the static business function files to the process automation client when the process automation client has the authority to use the static business function files to perform the above-mentioned business operations, which can effectively improve the security of robotic process automation operations.

[0025] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1 A schematic diagram of the structure of a security management server provided by an embodiment of the present invention is shown;

[0028] Figure 2 A schematic diagram showing the structure of another security management server provided by an embodiment of the present invention is shown;

[0029] Figure 3 A schematic diagram of the structure of a process automation client provided by an embodiment of the present invention is shown;

[0030] Figure 4 A schematic structural diagram of a process automation system provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0031] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0032] In one embodiment, Figure 1 As shown, a security management server is provided, and the application of the security management server to computer devices such as servers is used as an example for explanation. The security management server includes an identity authentication module and a permission control module.

[0033] In the security management server, the identity authentication module is used to receive account authentication information from a process automation client, determine whether the process automation client has the authority to log in to the security management server based on the account authentication information, and determine the authority information of the process automation client based on the account authentication information when the process automation client has the authority to log in to the security management server.

[0034] Specifically, a user using a process automation client can complete a login operation by sending account authentication information to the identity authentication module, and the identity authentication module performs identity authentication based on the account authentication information sent by the user to ensure security control of data within the process automation system. Here, the identity authentication module determines whether the process automation client has the authority to log in to the security management server based on the account authentication information, and determines the authority information pre-mapped and stored with the account authentication information when the process automation client has the authority to log in to the security management server.

[0035] Among them, the account authentication information may include the account information of the user using the process automation client and the fingerprint, facial image, eye image and other related information collected by the user through the information collector at the process automation client for distinguishing the identity of the natural person, so that the identity authentication module can complete the one-to-one binding of the user using the process automation client and the system account through Internet Protocol (IP) binding, domain control login and two-factor login technology, ensuring that the ownership and execution rights of the account are in the hands of the user himself, and can track the user based on the account authentication information to ensure the security of user data.

[0036] Furthermore, the permission control module is used to receive the application information for the static business function file sent by the process automation client, determine whether the process automation client has the application permission for the static business function file based on the permission information, and send the pre-stored static business function file to the process automation client when the process automation client has the application permission. The static business function file is used to enable the robotic process automation executor set at the process automation client to perform the robotic process automation operation corresponding to the static business function file; further, the static business function file can be pre-stored in the security management server, and each static business function file carries preset permission requirement information.

[0037] Here, when a user using a process automation client wishes to obtain a static business function file in order to perform a robotic process automation operation through a robotic process automation executor set at the process automation client, the user can apply for the static business function file required for performing the relevant business operation by sending application information to the authority control module. Here, the application information may include identification information of the required static business function file. Further, when the authority control module receives the application information, it obtains the authority information of the process automation client from the identity authentication module, and determines whether the authority information meets the authority requirement information of the static business function file applied by the process automation client through department security authentication, level authority authentication, and role authority authentication. When the authority information meets the authority requirement information, it is determined that the process automation client has the application authority to apply for the static business function file.

[0038] Furthermore, after determining that the process automation client has the application authority to apply for the static business function file, the authority control module sends the static business function file to the process automation client so that the robotic process automation executor of the process automation client can perform related business operations based on the static business function file.

[0039] The security management server provided in this embodiment first obtains the account authentication information sent by the process automation client that executes the robotic process automation operation by the identity authentication module of the security management server to determine the authority information corresponding to the process automation client. Then, the authority control module of the security management server obtains the application information sent by the process automation client, wherein the application information includes the static business function file required when the process automation client wants to perform the business operation. Further, the authority control module determines whether the process automation client has the authority to perform the business operation based on the static business function file applied by it, and when the process automation client has the authority to perform the business operation based on the static business function file applied by it, the above-mentioned static business function file is sent to the process automation client, so that the process automation client can perform the robotic process automation operation corresponding to the static business function file based on the static business function file. Conversely, when the process automation client does not have the authority to perform the business operation based on the static business function file applied by it, the above-mentioned static business function file is not sent to the process automation client, so that the process automation client cannot perform the robotic process automation operation corresponding to the static business function file. The technical solution provided by the present application can send static business function files of business operations that the user has the authority to perform to the process automation client, so that the process automation client only performs robotic process automation operations within its authority scope, thereby controlling the user's visible range and operable range in the system, effectively avoiding illegal operations such as crossing roles, crossing authorities, and crossing levels, and improving the security when executing robotic process automation operations.

[0040] In an optional embodiment, if Figure 2 As shown, the security management server also includes a security management module and an application management module.

[0041] The application management module is used to obtain static business function files, and manage and store the static business function files. Here, the static business function files can be sent to the application management module in advance so that the application management module stores the static business function files. When the process automation client needs to obtain the static business function files, the application management module sends the static business function files to the process automation client.

[0042] Furthermore, the security management module is used to obtain log information generated when the robotic process automation executor executes the robotic process automation operation based on the static business function file, and determine whether an execution exception occurs when the robotic process automation executor executes the robotic process automation operation based on the log information.

[0043] Specifically, when the process automation client logs in to the security management server, and based on the static business function file obtained from the security management server, the robotic process automation executor in the process automation client executes the robotic process automation operation corresponding to the static business function file, the security management module can obtain the log information generated by the robotic process automation executor in real time due to the execution of the robotic process automation operation, and analyze the log information, timely discover the execution anomalies such as errors, anomalies, and over-limit events of the robotic process automation operation in the system, and discover and locate events, accidents and problems in the system, so as to discover threats through log monitoring. Furthermore, the security management module can store the log information to facilitate subsequent backtracking work.

[0044] The embodiments provided in the present application can pre-acquire and store static business function files based on the application management module, and the security management module can determine whether the robotic process automation operation of the process automation client has errors, exceptions, over-limit events or other execution exceptions based on the log information generated by the process automation client, thereby improving the security when executing robotic process automation operations.

[0045] In an optional embodiment, the application management module includes an application interface submodule; here, the application interface submodule is used to access an external system to establish data interaction between the security management server and the external system.

[0046] Among them, the external system can be a business system that is connected to the security management server from the outside to operate or interact with the security management server. Furthermore, the main function of the application interface submodule is to provide the data or operation interface of this server to the external system to provide data services and functional services, and provide other operation methods besides UI operations. The external system can connect to the security management server through the interface provided by the application interface submodule to operate the security management server, send data to the security management server, or obtain data from the security management server.

[0047] The embodiment provided by the present application can connect the security management server to an external system through the application interface submodule, can obtain static business function files from the external system, and can enable relevant staff to control the working process of the security management server through the external system, thereby improving the operability of the security management server. In an optional embodiment, the application management module also includes a configuration management submodule and a source verification submodule.

[0048] Wherein, the configuration management submodule is used to respond to the configuration operation of the configuration management submodule to obtain the static business function file. Specifically, the configuration management submodule can be connected to an external computer terminal, and the relevant staff can connect to the configuration management submodule through the computer terminal, and through the configuration operation of the configuration management submodule on the configuration file contained in the static business function file, the configuration information of the static business function file can be supplemented for different robot process automation operations to obtain a usable static business function file, so as to improve the adaptability of the static business function file to different robot process automation operations. Further, the source verification submodule is used to perform a security check on the static business function file received from the external system, and when the static business function file passes the security check, the static business function file is stored in the application management module. Specifically, when it is necessary to obtain a static business function file from an external system, it is necessary to determine the reliability of the obtained static business function file to ensure that the static business function file comes from a reliable source. Furthermore, the source verification submodule may use identity authentication and access control to perform security verification on static business function files accessed from the outside to ensure the reliability of the static business function files.

[0049] The embodiment provided by the present application supplements the configuration information of the static business function files for different robotic process automation operations through the configuration management submodule to obtain usable static business function files, so that the static business function files can adapt to different robotic process automation operations when minor changes are made to the static business function files; further, the security of the static business function files accessed from the external system can be ensured through the source verification submodule, so that the static business function files received by the application management module are credible, enriching the ways of static business function files.

[0050] In an optional embodiment, the source verification submodule performs security verification on the static business function file in the following manner: first, the source verification submodule obtains the identity information of the external system as the source of the static business function file, and compares the identity information with a plurality of pre-stored trusted identity information to determine whether the identity information is the same as one of the trusted identity information in the plurality of trusted identity information. The identity information may be IP information and computer network domain information, etc. Further, the trusted identity information may be stored in advance as the trusted identity information.

[0051] Then, when the identity information is the same as one of the multiple trusted identity information, it is determined that the external system as the source of the static business function file has passed the security check, and then the static business function file has passed the security check. The embodiment provided by the present application can ensure that each external system that sends a static business function file is a trusted information source by performing a security check on the external system, thereby ensuring that the static business function file will not cause the process automation client to perform unauthorized operations, and ensuring the security when executing robotic process automation operations.

[0052] In an optional embodiment, the method in which the authority control module determines whether the process automation client has the application authority to apply for the static business function file based on the authority information further includes:

[0053] First, the permission control module sends the identification information of the static business function file applied for by the process automation client and the permission information of the process automation client to a remote host computer; wherein the identification information may be the name information of the static business function file, or may record relevant information such as the operations performed, the interface entered, the operated files, and the connected systems when the process automation client executes the static business function file; further, the host computer may be a computer terminal used by managers with corresponding management and approval authority, so that when the relevant managers confirm that the process automation client has the authority to use the static business function file, they send permission authentication instructions to the permission control module.

[0054] Furthermore, in response to the permission authentication instruction sent by the host computer, the static business function file is sent to the process automation client. In the embodiment provided by the present application, the permission information of the process automation client and the identification information of the static business function file applied by it can be sent to the computer terminal of the manager with management and approval authority, and the manager determines whether the user using the process automation client has the authority to use the static business function file, thereby improving the security when executing the robotic process automation operation.

[0055] In an optional embodiment, the security management service end also includes a business audit module; specifically, the business audit module is used to obtain the operation record when the process automation client performs the robotic process automation operation and the log information generated when the robotic process automation operation is performed, and send the operation record and the log information to a remote audit host computer. Among them, the audit host computer can be a computer terminal used by relevant management personnel with operation audit authority and log analysis authority. In the embodiment provided by the present application, the operation record when the process automation client performs the robotic process automation operation and the log information generated when the robotic process automation operation is performed can be obtained from the process automation client through the business audit module, and the operation record and the log information can be sent to the audit host computer, so that the relevant staff can audit the operation behavior in the process automation client at the audit host computer, and discover threatening operations through log monitoring, thereby improving the security when performing robotic process automation operations.

[0056] In an optional embodiment, the application management module further includes an executor management submodule. The executor management submodule is used to determine the working state of the robotic process automation executor, and to control the robotic process automation executor to stop executing the robotic process automation operation and control the process automation client to deregister the robotic process automation executor. Specifically, the executor management submodule can be connected to the process automation client, determine the online and offline states of the robotic process automation executor in the process automation client, and whether it is in a running state, and receive the above state information to the security management server. Further, the executor management submodule can be controlled to stop the operation of the robotic process automation executor in the process automation client, force it to go offline, and disconnect the process automation client from the security management server, and can control the process automation client to deregister the robotic process automation executor set by itself. In the embodiment provided by the present application, the executor management submodule can determine the running state of the robotic process automation executor in the process automation client, and can control the robotic process automation executor to stop running and force it to go offline, and can disconnect the process automation client from the security management server, thereby improving the controllability of the state of the process automation client executing the robotic process automation operation.

[0057] Furthermore, the authority control module can provide relevant personnel with authority with corresponding functional interfaces, such as management interfaces for multiple process automation clients, so that relevant personnel with authority can determine relevant information such as the operation status of each process automation client through the functional interface. Specifically, corresponding management authority can be set for the account authentication information of relevant personnel with authority. When the above account authentication information is used to log in to the security management server, the authority control module can analyze the account authentication information to determine whether the account authentication information has management authority; when the account authentication information has management authority, specific functional interfaces, buttons and necessary data can be opened for the computer terminal of the relevant personnel with authority, so that the relevant personnel can perform corresponding management work in the functional interface.

[0058] The security management server provided by this application can send the static business function files corresponding to the business operations that the user has the authority to perform to the process automation client, so that the process automation client can only perform the robotic process automation operations within its authority, control the user's visible range and operable range in the system, and effectively avoid illegal operations such as crossing roles, crossing permissions, and crossing levels. It can also analyze and store the log information generated by the user's business operations to determine whether the user has exceeded the limit, and can control the working status of the robotic process automation executor of the process automation client used by the user, effectively improving the security when executing robotic process automation operations.

[0059] Further, such as Figure 3 As shown, this embodiment provides a process automation client, including a robotic process automation executor, a management module, a visualization interface, a login module and a log module. Among them, the robotic process automation executor is used to perform robotic process automation operations based on static business function files, the management module is used to manage the operation process of the process automation client, the visualization interface is used to provide users with a visual operation interface, the login module is used to log the process automation client to the security management server, and the log module is used to obtain the log information generated when the robotic process automation executor performs robotic process automation operations based on static business function files, and store the log information, and can send the log information to the security management server. Further, the process automation client is configured to perform the following processing:

[0060] First, the account authentication information and the application information for obtaining the static business function file are sent to the security management server. The security management server is used to receive the account authentication information from the process automation client, determine whether the process automation client has the authority to access the security management server based on the account authentication information, and determine the authority information of the process automation client based on the account authentication information when the process automation client has the authority to access the security management server. Further, the security management server is also used to respond to the application information for the static business function file sent by the process automation client, determine whether the process automation client has the application authority to apply for the static business function file based on the authority information, and send the pre-stored static business function file to the process automation client when the process automation client has the application authority. The static business function file is used to enable the robotic process automation executor set at the process automation client to perform the robotic process automation operation corresponding to the static business function file.

[0061] Specifically, a user can send account authentication information to the security management server through the process automation client to log in, and the security management server determines the permission information of the process automation client of the user. Furthermore, when a user using the process automation client needs to use the robotic process automation technology to perform business operations, he can send application information to the security management server, wherein the application information records the identification information of the static business function file required for the robotic process automation executor to perform the business operation. Furthermore, when the security management server receives the application information and determines that the process automation client has the permission to use the static business function file required to perform the business operation, it sends the above-mentioned static business function file to the process automation client.

[0062] Further, the process automation client receives the static business function file sent by the security management server, and in response to the execution command for the static business function file, executes the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client. Specifically, after the process automation client receives the required static business function file, the user can send an execution command to the process automation client so that the process automation client executes the robotic process automation operation corresponding to the static business function file based on its own robotic process automation executor, so as to execute the business operation based on the robotic process automation technology.

[0063] The process automation client provided in this embodiment can send account authentication information and application information for obtaining static business function files to the security management server, so that the security management server can send the static business function files requested by the application information to the process automation client when it determines that the process automation client has the authority to use the static business function files based on the account authentication information. Furthermore, after the process automation client executes the static business function files, it can automatically execute the business operations corresponding to the static business function files based on the robotic process automation technology. The technical solution provided by itself can obtain the authorized static business function files from the security management server, avoid unauthorized behavior in the robotic process automation operations of the process automation client, and effectively improve the security when performing robotic process automation operations.

[0064] In an optional embodiment, the process automation client performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client, including:

[0065] First, the process automation client obtains from the security management server the permission information of the process automation client determined by the security management server based on the account authentication information, and the permission requirement information corresponding to the static business function file; wherein the permission requirement information is the permission requirement that needs to be met by the permission information of the process automation client to execute the static business function file.

[0066] Specifically, when the user wants the process automation client to execute the robotic process automation operation corresponding to the static business function file, the robotic process automation executor loads the static business function file and performs pre-startup. At this time, the process automation client can obtain the permission information of the process automation client and the permission requirement information required to execute the static business function file from the security management server.

[0067] Further, determining whether the permission information of the process automation client satisfies the permission requirement information; further, when the permission information of the process automation client satisfies the permission requirement information, executing the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor. Conversely, when the permission information of the process automation client does not satisfy the permission requirement information, destroying the static business function file.

[0068] In the actual working process, after obtaining the static business function file through the process automation client and before executing the static business function file, the user may lose the right to use the static business function file due to work changes or other reasons, or after the security management server sends the static business function file to the process automation client, the permission requirements for using the static business function file change. If the above situation occurs, it may cause users who do not have the authority to use the static business function file to perform business operations beyond their authority. However, through the embodiments provided by the present application, before the process automation client uses the static business function file to perform business operations, the latest permission information of the process automation client and the permission requirement information corresponding to the static business function file can be obtained from the security management server, and then it can be determined whether the user currently using the process automation client has the authority to use the static business function file, and the static business function file is used only when the user currently using the process automation client has the authority to use the static business function file. Conversely, when the user currently using the process automation client does not have the authority to use the static business function file, the static business function file is destroyed in time to ensure security.

[0069] In an optional embodiment, the process automation client performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client, and the method further includes:

[0070] First, the process automation client sends static business function file status determination information containing identification information of the static business function file to the security management server, so that after receiving the static business function file status determination information, the security management server sends the status information of the static business function file to the process automation client, wherein the status information includes normal status information and static business function file cancellation information.

[0071] Here, the status information of the static business function file includes normal status information and static business function file cancellation information. When the static business function file can be used normally, the security management server will mark the status information of the static business function file as normal status information. Conversely, when a static business function file is cancelled, the security management server will record the identification information of the cancelled static business function file and mark the status information of the cancelled static business function file as static business function file cancellation information.

[0072] Specifically, when the user wants the process automation client to execute the robotic process automation operation corresponding to the static business function file, the robotic process automation executor loads the static business function file and performs pre-startup. At this time, the process automation client will send static business function file status determination information containing the identification information of the above-mentioned static business function file to the security management server. Here, the identification information can be the name information or number information of the static business function file. Further, when the security management server receives the static business function file status determination information, it can determine whether the static business function file corresponding to the static business function file status determination information is a static business function file that has been cancelled. If the static business function file is a static business function file that has been cancelled, the static business function file cancellation information can be sent to the process automation client.

[0073] Further, the process automation client receives the state information, and when the state information is the normal state information, the process automation client executes the robot process automation operation corresponding to the static business function file based on the robot process automation executor. Conversely, when the state information is the static business function file cancellation information, the static business function file is destroyed.

[0074] In the actual working process, when a static business function file is cancelled during the time period between being sent to the process automation client and the process automation client executing the static business function file, if the process automation client executes the static business function file, it may cause the robotic process automation executor to perform an erroneous business operation, which may cause security issues. However, through the embodiments provided by the present application, before the process automation client uses the static business function file to perform a business operation, it is possible to obtain the latest status information of the static business function file from the security management server, and then determine whether the current static business function file is a cancelled static business function file, and use the static business function file only when the currently used static business function file has not been cancelled. Conversely, when the currently used static business function file is cancelled, the static business function file is destroyed in time to ensure security.

[0075] In an optional embodiment, the operation objects of the robotic process automation executor performing the robotic process automation operation are preset with permission condition information; wherein, the operation objects of the robotic process automation operation may be files, programs, interface buttons, etc. involved in performing the robotic process automation operation, and each operation object is preset with corresponding permission condition information, and the permission condition information of each operation object may be pre-stored in the security management server.

[0076] Furthermore, the process automation client is also configured to perform the following processing:

[0077] First, determine the permission condition information of the operation object on which the robotic process automation executor is to perform the robotic process automation operation; specifically, when performing the robotic process automation operation, before each operation on an operation object, send the identification information corresponding to the operation object to the security management server, so that the security management server determines the permission condition information of the operation object based on the identification information, and sends the permission condition information of the operation object back to the process automation client.

[0078] Then, determine whether the permission information of the process automation client satisfies the permission condition information; specifically, the permission information of the process automation client previously obtained can be compared with the permission condition information to determine whether the permission information of the process automation client satisfies the permission condition information of the operation object.

[0079] Furthermore, if the permission information does not satisfy the permission condition information, the robotic process automation operation is not performed on the operation object. At this time, the robotic process automation executor can skip the operation object and perform other operations. Conversely, if the permission information satisfies the permission condition information, the operation object is operated. The embodiment provided by the present application can perform permission authentication for each operation performed by the robotic process automation executor to ensure the security of the process automation system.

[0080] The process automation client provided in this embodiment can obtain the static business function files that it is authorized to use from the security management server, thereby preventing the process automation client from unauthorized behavior in the robotic process automation operation. Before using the static business function files, the permissions of the process automation client and the status of the static business function files are confirmed again. When the process automation client operates the operation object, it is determined whether the process automation client has the authority to perform the operation, thereby effectively ensuring the security of the process automation operation.

[0081] Furthermore, this embodiment provides a process automation system, such as Figure 4 As shown, the process automation system includes the above-mentioned security management server and the above-mentioned process automation client. Through the process automation system, the business process can be automated by using the robotic process automation technology while ensuring security.

[0082] Those skilled in the art will appreciate that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present application. Those skilled in the art will appreciate that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the description of the implementation scenario, or can be changed accordingly and located in one or more devices different from the present implementation scenario. The modules of the above-mentioned implementation scenario can be combined into one module, or can be further split into multiple submodules.

[0083] The above serial numbers of this application are only for description and do not represent the advantages and disadvantages of the implementation scenarios. The above disclosure is only a few specific implementation scenarios of this application, but this application is not limited to them, and any changes that can be thought of by technicians in this field should fall within the scope of protection of this application.

Claims

1. A security management server, applied to a server, characterized in that: The security management server includes an identity authentication module and a permission control module; The identity authentication module is used to receive account authentication information from the process automation client, determine whether the process automation client has the authority to log in to the security management server based on the account authentication information, and determine the authority information of the process automation client based on the account authentication information when the process automation client has the authority to log in to the security management server; The authority control module is used to receive application information for a static business function file sent by the process automation client, determine whether the process automation client has application authority for the static business function file based on the authority information, and send the pre-stored static business function file to the process automation client when the process automation client has the application authority; The static business function file is used to enable the robotic process automation executor provided at the process automation client to perform the robotic process automation operation corresponding to the static business function file.

2. The security management server according to claim 1, characterized in that: The security management server also includes a security management module and an application management module; The application management module is used to obtain the static business function file, and store and manage the static business function file; The security management module is used to obtain log information generated when the robotic process automation executor executes the robotic process automation operation based on the static business function file, and determine whether an execution exception occurs when the robotic process automation executor executes the robotic process automation operation based on the log information.

3. The security management server according to claim 2, characterized in that: The application management module includes an application interface submodule; The application interface submodule is used to access an external system to establish data interaction between the security management server and the external system.

4. The security management server according to claim 2, characterized in that: The application management module also includes a configuration management submodule and a source verification submodule; The configuration management submodule is used to obtain the static business function file in response to a configuration operation on the configuration management submodule; The source verification submodule is used to perform security verification on the static business function file received from the external system, and when the static business function file passes the security verification, store the static business function file in the application management module.

5. The security management server according to claim 4, characterized in that: The method in which the source check submodule performs security check on the static business function file includes: The source verification submodule obtains the identity information of the external system as the source of the static business function file, and compares the identity information with a plurality of pre-stored trusted identity information to determine whether the identity information is the same as one of the trusted identity information in the plurality of trusted identity information; When the identity information is identical to one of the multiple trusted identity information, it is determined that the static service function file passes the security check.

6. The security management server according to claim 3, characterized in that: The application management module also includes an executor management submodule; The executor management submodule is used to determine the working state of the robotic process automation executor, and to control the robotic process automation executor to stop executing the robotic process automation operation and control the process automation client to log out of the robotic process automation executor.

7. The security management server according to claim 1, characterized in that: The method in which the authority control module determines whether the process automation client has the application authority to apply for the static business function file based on the authority information includes: The authority control module sends the identification information of the static business function file applied for by the process automation client and the authority information of the process automation client to a remote host computer; In response to the authority authentication instruction sent by the host computer, the static business function file is sent to the process automation client.

8. The security management server according to claim 1, characterized in that: The security management server also includes a business audit module; The business audit module is used to obtain the operation record when the process automation client executes the robotic process automation operation and the log information generated when the robotic process automation operation is executed, and send the operation record and the log information to a remote audit host computer.

9. A process automation client, used for data interaction with a security management server according to any one of claims 1 to 8, characterized in that: The process automation client is configured to perform the following processing: Sending account authentication information and application information for obtaining static business function files to the security management server; Receive the static business function file sent by the security management server, and in response to an execution command for the static business function file, execute the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client.

10. The process automation client according to claim 9, characterized in that: The manner in which the process automation client performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client includes: The process automation client obtains, from the security management server, permission information of the process automation client determined by the security management server based on the account authentication information, and permission requirement information corresponding to the static business function file; Determining whether the permission information of the process automation client satisfies the permission requirement information; When the permission information of the process automation client meets the permission requirement information, a robotic process automation operation corresponding to the static business function file is performed based on the robotic process automation executor.

11. The process automation client according to claim 9, characterized in that: The method in which the process automation client performs the robotic process automation operation corresponding to the static business function file based on the robotic process automation executor set at the process automation client also includes: The process automation client sends static business function file status determination information including identification information of the static business function file to the security management server, so that the security management server sends the status information of the static business function file to the process automation client after receiving the static business function file status determination information, wherein the status information includes normal status information and static business function file cancellation information; The state information is received, and when the state information is the normal state information, a robotic process automation operation corresponding to the static business function file is executed based on the robotic process automation executor.

12. The process automation client according to claim 9, characterized in that: The operation object of the robotic process automation executor executing the robotic process automation operation is preset with permission condition information; The process automation client is further configured to perform the following processing: Determine permission condition information of an operation object on which the robotic process automation executor is to perform a robotic process automation operation; Determining whether the permission information of the process automation client satisfies the permission condition information; If the permission information does not satisfy the permission condition information, the robot process automation operation is not performed on the operation object.

13. A process automation system, characterized in that: The process automation system comprises the security management server as claimed in any one of claims 1 to 8, and the process automation client as claimed in any one of claims 9 to 12.

Images