Workflow data processing method

Abstract

The embodiment of the invention provides a workflow data processing method. The method comprises the following steps: triggering an enterprise user workflow initiation request; acquiring a service party public key and an enterprise user public key of a current working node in the workflow nodes from a workflow authorization file generated according to the workflow initiation request on the server side of the workflow data protection system; generating an encryption factor; encrypting the working data of the enterprise user according to the encryption factor to obtain ciphertext data; encrypting the encryption factor according to the enterprise user public key to obtain first encryption factor ciphertext data; encrypting the encryption factor according to the public key of the service party to obtain second encryption factor ciphertext data; the ciphertext data, the first encryption factor ciphertext data and the second encryption factor ciphertext data are uploaded to a workflow data protection system server side to be stored corresponding to a workflow authorization file; wherein the ciphertext data and the first encryption factor ciphertext data correspond to an enterprise user public key, and the ciphertext data and the second encryption factor ciphertext data correspond to a service party public key.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for processing workflow data. Background Art

[0002] The existing intellectual property registration application services basically rely on human brainpower and physical strength to implement their workflows, use patent process software to centrally manage all files, and realize centralized management and scheduling of service workflows. The patent agency company acts as a central server to provide information exchange within the company's email network or workflow for corporate Party A and patent agents. For corporate Party A, it is difficult to confirm the specific service person who writes the materials, and it is also difficult to confirm whether it is the designated contracted patent agent who is processing it. Therefore, for intellectual property service talents with professional capabilities, it is necessary to demonstrate their valuable service capabilities. While ensuring the quality of service, it is also necessary to ensure the confidentiality and security of file data in the service process.

[0003] This problem exists in the fields of intellectual property rights such as patents, trademarks, copyrights, legal affairs, and corporate services, as long as there is electronic information exchange between professional service personnel between enterprises and service agencies, and between enterprises and national authorization, litigation, arbitration and other institutions. How to organize the workflow between these relevant entities efficiently and ensure the information security and privacy of the relevant parties has become a trend in the development of products and services.

[0004] In the patent with the published application number CN201910125120.7 and the patent name "Patent Writing and Reply Project Management System", a patent writing and reply project management system is disclosed, including a patent application information registration system, a patent project allocation unit, a patent technology briefing project and / or reply file download unit, and a writing project and / or reply file production and upload unit; the present invention can quickly assign each patent to the corresponding agent, and the system can automatically monitor the progress of the project without manual supervision and management. The agent writes the reply file and uploads it to the system, and the process personnel can import and submit it with one click. The whole process is short, efficient, time-saving and labor-saving, and one person can manage all electronic files. However, the prior art still does not provide any inspiration and technical solution disclosure on how to efficiently organize the workflow between the relevant subjects of patent writing and replying, and ensure the information security and information privacy of the relevant parties. Summary of the invention

[0005] The embodiment of the present invention provides a method for processing workflow data, which is used to achieve efficient professional generation of workflows for enterprises and ensure the privacy rights and interests of user data in the workflow.

[0006] In the first aspect, an embodiment of the present invention provides a method for processing workflow data, which runs on the client side of an enterprise user, including: triggering a first workflow initiation request of the enterprise user; obtaining the public key data of the first service provider of the current work node in the first workflow node and the public key data of the enterprise user from the first workflow authorization file generated on the server side of the workflow data protection system according to the first workflow initiation request; generating a first encryption factor; encrypting the first work data of the enterprise user according to the first encryption factor to obtain first ciphertext data; encrypting the first encryption factor according to the public key of the enterprise user to obtain first encryption factor ciphertext data; encrypting the first encryption factor according to the public key of the first service provider to obtain second encryption factor ciphertext data; uploading the first ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data to the server side of the workflow data protection system and saving them in correspondence with the first workflow authorization file; wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the public key of the enterprise user in the first workflow authorization file, and the first ciphertext data and the second encryption factor ciphertext data correspond to the public key of the first service provider in the first workflow authorization file.

[0007] Optionally, the workflow data processing method further includes: monitoring the enterprise user's first triggering request for the first workflow; obtaining the enterprise user's public key and enterprise user's private key that can be used for asymmetric encryption and decryption; storing the enterprise user's private key on the client side; uploading the enterprise user's public key to the workflow data protection system server for storage.

[0008] Optionally, the first workflow authorization file includes: at least one workflow node generated according to the workflow type corresponding to the first workflow initiation request; the enterprise party, service party and their respective public key data involved in each workflow node; and a description of the corresponding authorization content of the enterprise party and service party involved in each workflow node.

[0009] Optionally, the description of the authorization content includes: whether the enterprise party and service party involved in each workflow node can encrypt and decrypt the workflow file; and / or the authorization duration of the workflow file in each workflow node; and / or whether the enterprise party and service party involved in each workflow node can initiate re-authorization; and / or the configuration of the payment work node.

[0010] Optionally, the workflow data processing method further includes: when triggering the first workflow initiation request of the enterprise user, the workflow data protection system server uses the enterprise user's public key to encrypt the first random string and sends it to the enterprise user's client side; decrypts the encrypted first verification code according to the enterprise user's private key, and sends the decrypted verification code back to the workflow data protection system server; if the verification code received by the workflow data protection system server is consistent with the first verification code, the identity of the enterprise user is confirmed.

[0011] Optionally, the workflow data processing method further includes: triggering a decryption and viewing processing request for the first work data of the enterprise user; after the workflow data protection system server determines that the description in the first workflow authorization file corresponding to the enterprise user meets the authorization conditions, obtaining the first ciphertext data and the first encryption factor ciphertext data of the first work data in the current workflow node from the workflow data protection system server; obtaining the enterprise user private key of the enterprise user from the enterprise user client; decrypting the first encryption factor ciphertext data based on the enterprise user private key to obtain the first encryption factor; decrypting the first ciphertext data based on the first encryption factor to obtain the first work data.

[0012] Optionally, the workflow data processing method further includes: obtaining the service provider information involved in the current workflow node in the first workflow authorization file in the workflow data protection system server; initiating an update request for the service provider information involved in the current workflow node; obtaining the description information of the service provider that can provide similar services in the workflow data protection system server; obtaining the second service provider selected by the enterprise user from the service providers that can provide similar services; updating the service provider information of the current workflow node in the first workflow authorization file in the workflow data protection system server to the second service provider information; encrypting the first encryption factor according to the second service provider public key to obtain the third encryption factor ciphertext data; uploading the first ciphertext data and the third encryption factor ciphertext data to the workflow data protection system server corresponding to the second service provider public key in the first workflow authorization file.

[0013] Optionally, the workflow data processing method further includes: sending service completion information in the current workflow node to the workflow data protection system server; checking at the workflow data protection system server that the ciphertext data and encryption factor ciphertext data in the current workflow node have been uploaded by the enterprise and / or service party; the corresponding authorization content of the enterprise and service party involved in the current workflow node in the first workflow authorization file complies with the description of the authorization status; obtaining the third service party information involved in the next workflow node of the current workflow node; updating the current workflow node in the first workflow authorization file in the workflow data protection system server to the next workflow node, and updating the service party information therein to the third service party information; sending the third service party public key to the enterprise user client side; encrypting the first encryption factor according to the third service party public key to obtain the fourth encryption factor ciphertext data; uploading the first ciphertext data, the first encryption factor ciphertext data, and the fourth encryption factor ciphertext data to the workflow data protection system server and saving them corresponding to the first workflow authorization file; wherein the first ciphertext data and the fourth encryption factor ciphertext data correspond to the third service party public key in the first workflow authorization file.

[0014] Optionally, the workflow data processing method further includes: obtaining the content of the first official electronic letter through a network interface; triggering a second workflow initiation request of the enterprise user based on the identified content of the first official electronic letter; obtaining the public key data of the fourth service provider of the current work node in the second workflow node and the public key data of the enterprise user from the second workflow authorization file generated based on the second workflow initiation request on the server side of the workflow data protection system; generating a second encryption factor; encrypting the second work data of the enterprise user based on the second encryption factor to obtain second ciphertext data; encrypting the second encryption factor based on the public key of the enterprise user to obtain fifth encryption factor ciphertext data; encrypting the second encryption factor based on the public key of the fourth service provider to obtain sixth encryption factor ciphertext data; uploading the second ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data to the server side of the workflow data protection system and saving them in correspondence with the second workflow authorization file; wherein the second ciphertext data and the fifth encryption factor ciphertext data correspond to the public key of the enterprise user in the second workflow authorization file, and the second ciphertext data and the sixth encryption factor ciphertext data correspond to the public key of the fourth service provider in the second workflow authorization file.

[0015] Optionally, before initiating an update request for the service provider information involved in the current workflow node, it further includes: obtaining service completion status information of the service provider involved in the current workflow node; predicting the quality parameters of the service provider completing the service based on the service completion status information; and sending the quality parameters of the service workflow to the enterprise user client side.

[0016] Optionally, the workflow data processing method further includes: sending service completion information in the current workflow node to the workflow data protection system server; the workflow data protection system server detects that the next workflow node in the current workflow node in the first workflow authorization file is the enterprise payment workflow node; settles the amount to be paid in the current workflow node; generates link information that the enterprise can pay; encrypts the link information that the enterprise can pay according to the enterprise user's public key to obtain first encrypted payment ciphertext data; sends the first encrypted payment ciphertext data to the enterprise user's client side; the enterprise user uses its enterprise user private key to decrypt the link information that the enterprise can pay and then completes the payment.

[0017] By adopting the present invention, the enterprise user can trigger the workflow on its client side, and cooperate with the workflow authorization file on the server side of the workflow data protection system, use the service party public key of the current working node and the enterprise user public key, and then realize the encryption of the data to be processed, and upload it to the workflow data protection system server side and save it in correspondence with the workflow authorization file, so that subsequent enterprise users and service party users can use their private keys to decrypt and interact with each other. It can be seen that in the present invention, enterprise users use workflow authorization files to realize the generation of efficient and professional workflows for enterprise needs, and use public-private key pairs to ensure the privacy protection of user work data in the workflow for enterprise users. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A flowchart of a method for processing workflow data provided in Embodiment 1 of the present invention; Figure 2 A schematic diagram of the composition of the authorization file provided in the second embodiment of the present invention; Figure 3 A schematic diagram of a workflow data processing system provided in Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the interactive process of generating public and private keys of an enterprise user when the enterprise user initiates a workflow for the first time in the third embodiment of the present invention; Figure 5 This is a workflow diagram of encryption processing for enterprise users in Embodiment 3 of the present invention; Figure 6This is a workflow diagram of the decryption process for enterprise users in Embodiment 3 of the present invention; Figure 7 This is a workflow diagram of an enterprise user changing a service provider in Embodiment 3 of the present invention; Figure 8 This is a flow chart of the process of an enterprise user completing the current working node and starting the next node in the third embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.

[0022] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0023] In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0024] In an embodiment of the present invention, by separating the work data in the workflow from the authorization file, and allowing the user to encrypt and decrypt the work data, the authorization content of the authorization file is adjusted based on the experience process and legal process of the specific workflow, as well as the comprehensive analysis of the processing of enterprise users and service users by the AI ​​model to adjust the work node processors, work node processing rhythm, work node processing content, etc. in the workflow, thereby giving enterprise users greater management and flexible adjustment power to improve the efficiency and experience of service work. In an embodiment of the present invention, enterprise users use workflow authorization files to achieve efficient and professional workflow generation for enterprise needs, and use public-private key pairs to ensure the privacy protection of user work data in workflows for enterprise users.

[0025] In addition, the workflow in this embodiment is not limited to the workflow of patent agency services, the workflow of trademark registration services, the litigation workflow of legal lawyers, etc. given in the following preferred embodiments. As long as it is a specific service project between the enterprise and the service provider, the technical solution that initiates a specific workflow by performing the service work therein belongs to the scope of the inventive concept of the present invention.

[0026] Embodiment 1: Figure 1 A flowchart of a method for processing workflow data provided in the first embodiment of the present invention. In the first embodiment, the method for processing workflow data is run on the client side of an enterprise user. The method in the first embodiment of the present invention includes the following steps: Step 100: triggering the first workflow initiation request of the enterprise user; In this step, the enterprise user determines that a specific workflow needs to be initiated in the daily business operation, for example, in the field of intellectual property services, the enterprise is preparing to carry out a new patent application. At this time, the enterprise user opens the workflow management application pre-installed on its device (such as a computer, tablet or smartphone). The application can be an APP specially customized for intellectual property services, or a functional module integrated in the enterprise comprehensive management system, or the enterprise user triggers the web-level work transaction flow that interacts with external legal service agencies through the browser client. On the operation interface of the application, the enterprise user finds the function entrance related to patent application, such as the "Patent Application Process Start" button. After clicking the button, the application sends a request message containing specific identification and parameters to the workflow data protection system server through a pre-configured network communication protocol (such as the HTTPS protocol), thereby triggering the enterprise user's first workflow initiation request. This request message contains the enterprise user's unique identifier (such as the enterprise registration number or user name), request timestamp, workflow type identifier (here is the patent application workflow) and other information, so that the server can accurately identify and process the request. This embodiment takes the workflow of patent agency service as an example, which is only an example. Other workflows such as trademark registration service workflows, legal lawyers' litigation workflows, etc., as long as they are specific service projects between the enterprise and the service provider, and the technical solutions for initiating specific workflows to carry out the service work therein, all fall within the scope of the inventive concept of the present invention.

[0027] Preferably, in this embodiment, if the enterprise user client detects that the enterprise user is the first time to trigger the initiation request of the first workflow; obtain the enterprise user's public key and private key that can be used for asymmetric encryption and decryption; store the enterprise user's private key on the client side; upload the enterprise user's public key to the workflow data protection system server for storage. Preferably, this detection can be implemented in the SDK on the enterprise user client side, for example, based on the user's ID record, it can be determined whether it is the first time to initiate a certain type of workflow. In this embodiment, enterprise users can obtain the user public key and user private key for asymmetric encryption and decryption processing by themselves, and the public and private key pairs of enterprise users can also be obtained from a third-party public and private key pair provider, for example, a digital certificate authority CA (Certificate Authority) that can provide public and private key pairs for asymmetric encryption algorithms (such as RSA algorithms), and the public and private key pairs are provided by the network service interface of the CA of an official or non-profit organization; it is also preferable to generate a public and private key pair for the user in the asymmetric encryption algorithm such as the SDK software package of the present invention (the public and private key pairs in the SDK can also be generated and provided by a credible third party), so that enterprise users can quickly obtain the public and private key pairs. Preferably, the private key in this embodiment can be a browser cache or a client local cache. The private key in this embodiment is stored locally on the client side. In this embodiment, when the user needs to use the private key, the user needs to actively upload the private key to the SDK on the client side for decryption calculation. Since the private key in the public-private key pair is completely securely stored by the user, only the public key is uploaded to the workflow data protection system server. As a result, the workflow data protection system server only needs to perform public key hosting and encrypted data hosting, reducing the workload of client encryption processing and the amount of encrypted data transmitted between the workflow data protection system server and the workflow data protection system server, which not only ensures the security of enterprise users' workflow file data, but also improves the transmission efficiency of the solution of the present invention.

[0028] Step 101: Obtain the public key data of the first service provider of the current working node in the first workflow node and the public key data of the enterprise user from the first workflow authorization file generated by the workflow data protection system server side according to the first workflow initiation request; In this step, the workflow data protection system server of the present invention will generate a workflow authorization file (here, for example, an authorization file dedicated to the patent application workflow) based on the workflow type identifier of the first workflow in the first workflow initiation request. The authorization file includes the various work nodes for implementing the workflow assigned by the workflow data protection system server to the workflow, such as the work nodes for patent application work: writing and entrusting patent briefing documents, writing the first draft of patent application, reviewing the first draft of patent application, confirming and instructing the submission of patent application, submitting patent application, and paying patent fees. Moreover, in each work node, the information of the service provider is allocated, including the name of the service provider and the specific service provider of the service provider, as well as the public key corresponding to the service provider. The specific service provider of the service provider can be multiple people, but they can use the public key of the service provider uniformly. For example, the partners of the agency each have a backup of the same private key to decrypt the workflow file encrypted by the enterprise using the public key of the service provider; in each work node, there is also the name of the enterprise and the enterprise user information of the specific enterprise agent of the enterprise, as well as the public key corresponding to the enterprise user. For example, if the enterprise user is the legal representative of the enterprise, a pair of public and private keys is allocated to the legal representative. The public key is stored in the workflow data protection system server for easy use in the authorization file, and the private key is managed and used by the legal representative himself. The authorization file can also record the authorized content, such as: the authorization duration of the workflow file, whether the enterprise or service party involved in the workflow node can initiate the transfer authorization, and the configuration of the payment work node. For example, if the authorized processing duration of the workflow file is 5 days, the file can only be decrypted and processed within 5 days, which is convenient for the enterprise user to control the service time of the service party providing the service. In this way, the authorization file generated by the workflow data protection system server can facilitate the enterprise user who requests the service to obtain the public key data of the service provider of the current working node in the authorization file workflow node and the public key data of the enterprise user himself. The public and private key pairs in the embodiments here are preferably obtained from a third-party public and private key pair provider, such as a digital certificate authority CA (Certificate Authority) that can provide public and private key pairs for asymmetric encryption algorithms (such as RSA algorithms), and the public and private key pairs are provided by the network service interface of the CA of an official or non-profit organization.

[0029] Preferably, further in this example, when a workflow initiation request is triggered by an enterprise user, the workflow data protection system server uses the enterprise user's public key to encrypt a random string and sends it to the enterprise user's client side; the encrypted first verification code is decrypted according to the enterprise user's private key, and the decrypted verification code is returned to the workflow data protection system server; if the verification code received by the workflow data protection system server is consistent with the first verification code, the workflow data protection system server confirms the identity of the enterprise user. After the workflow data protection system server confirms the identity of the enterprise user, it will generate and set corresponding information for the enterprise user in the authorization description of its workflow authorization file. The random string in this embodiment is preferably generated using a specific random number generator or a function in a programming language.

[0030] Preferably, for example, when a workflow request is made for writing a patent application, after the workflow data protection system server receives a workflow initiation request from an enterprise user, the server first selects a corresponding template from a predefined workflow template library based on the workflow type identifier (patent application workflow) carried in the request. For example, a patent application workflow template may contain multiple standard workflow nodes, such as patent briefing writing, patent search, application document preparation, application submission, review and reply, etc. Then, the server generates a workflow authorization file based on the template. During the generation process, the server obtains the public key data of each party according to the information of the parties involved in the workflow (enterprise users and service providers). Assuming that the current working node is the writing of a patent briefing, the server determines the first service provider involved in the node (such as a cooperative patent agency) and obtains its public key data. At the same time, the server also obtains the public key data of the enterprise user (which has been uploaded and stored on the server when the enterprise user registered or used the system for the first time). The server side stores the generated workflow authorization file (including workflow node information, public key data of all parties, authorization content description, etc.) in the authorization file server, and returns the service party public key data and enterprise user public key data of the current working node to the enterprise user client through a secure network connection. After receiving the public key data, the enterprise user client stores it in the local memory or secure storage area for subsequent encryption operations.

[0031] Step 102: Generate a first encryption factor; The encryption factor in the steps of this embodiment can be a randomly generated key for symmetric encryption. Other encryption keys using symmetric encryption algorithms can be used as encryption factors in the first embodiment of the present invention. For example, the 128-bit encryption key in the national secret SM4 algorithm can be included in the scope of the present invention. Preferably, the present invention can use the AES (Advanced Encryption Standard) algorithm to generate a string of random binary sequences as keys through a secure random number generator, and the key length is 128 bits, 192 bits or 256 bits; the secure random number generator in this embodiment will ensure that the generated key has sufficient randomness based on complex algorithms and hardware entropy sources (such as thermal noise, clock jitter, etc.). Preferably, the first encryption factor is only used in the encrypted data of the current workflow. When a new workflow is initiated, the second encryption factor, the third encryption factor, etc. can be regenerated and applied to subsequent encryption processing to enhance the security level of encryption of the working files of enterprise users or service providers during the workflow process.

[0032] Step 103: Encrypting the first working data of the enterprise user according to the first encryption factor to obtain first ciphertext data; In this embodiment, preferably, since the first working data includes: any type of data in text, picture, audio, video, and specified format data, these working data are determined according to actual service needs. The first encryption factor performs different encryption processing processes on the working data of the enterprise user to encrypt and obtain the first ciphertext data. In this embodiment 1, it can be seen that there are many types of working data, which may lead to different encryption processing processes for the encryption confirmation method and specific process according to specific technical requirements, legal and regulatory requirements, product requirements and other factors. For example, when a patent application is provided with a technical disclosure book, some video data files or company internal encrypted files will be provided, and the specific requirements of encrypting and no longer being disclosed after being authorized to the customer for processing for 5 days. Or, for example, when a patent application is provided with a technical disclosure book, some public patent existing patent technical documents or technical materials during user research and development will be provided to prove that the user's invention is original. The processing of the first encryption factor can be a subsequent timestamp and a digital signature of a recognized authority to prepare for notarization. In this embodiment, for example, the first encryption factor is encrypted using an AES algorithm key to obtain the first ciphertext data.

[0033] Step 104: Encrypt the first encryption factor according to the enterprise user public key to obtain the first encryption factor ciphertext data; In this embodiment, the encryption factor is encrypted using the public key of the enterprise user, so that the encryption factor is kept confidential and the direct public key encryption of the workflow file data is avoided, thereby reducing the amount of encrypted data and improving the efficiency of decryption. In this step, the first encryption factor is encrypted using the public key of the enterprise user, so that the enterprise user's subsequent private key can be used to decrypt the first encryption factor, and then decrypt the encrypted workflow file data, that is, the first work data.

[0034] Step 105: Encrypt the first encryption factor according to the first service provider public key to obtain ciphertext data of the second encryption factor; In this embodiment, the encryption factor is also encrypted using the first service party's public key, so that the service party user's subsequent private key can decrypt the first encryption factor, and then decrypt the encrypted workflow file data, that is, the first work data. In this way, by encrypting the workflow file data to be processed with the public key, the parties who need to process the files in the work node, that is, the enterprise party and the service party, can encrypt and decrypt these workflow file data, and then use the authorization file to describe different permissions, so that the permissions of different strategies can be implemented to encrypt and decrypt these files, thereby facilitating the needs of the parties who need to process the files in the work node, especially the enterprise user can control the workflow node rhythm they need; further, it is convenient for the workflow data protection system server to implement the perfect workflow settings in the authorization file to achieve efficient and professional workflow node settings and permission descriptions.

[0035] Step 106: Upload the first ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data to the workflow data protection system server and save them in correspondence with the first workflow authorization file; wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the enterprise user public key in the first workflow authorization file, and the first ciphertext data and the second encryption factor ciphertext data correspond to the first service party public key in the first workflow authorization file.

[0036] In the above steps of the first embodiment, the ciphertext data, the encrypted factor ciphertext data of the service party and the enterprise party are uploaded to the workflow data protection system server, which are all encrypted data, ensuring the risk of data being decrypted or hijacked during transmission. On the workflow data protection system server, the ciphertext data, the encrypted factor ciphertext data and the workflow authorization file are saved in correspondence; in this way, the corresponding relationship between the ciphertext data, the enterprise encryption factor ciphertext data and the enterprise user public key in the first workflow authorization file is established, which is convenient for querying the enterprise encryption factor ciphertext data and ciphertext data corresponding to the enterprise public key, so that the enterprise can decrypt the workflow file data; similarly, in this way, the corresponding relationship between the ciphertext data, the service encryption factor ciphertext data and the service public key in the first workflow authorization file is established, which is convenient for querying the service encryption factor ciphertext data and ciphertext data corresponding to the service public key, so that the service can decrypt the workflow file data.

[0037] In the first embodiment of the present invention, preferably, the first workflow authorization file includes: at least one workflow node generated according to the workflow type corresponding to the first workflow initiation request; the enterprise party, service party and their respective public key data involved in each workflow node; the description of the corresponding authorization content of the enterprise party and service party involved in each workflow node. In the present invention, the workflow type can be: patent application writing, trademark registration application, civil lawsuit complaint writing, patent reexamination request writing, trademark reexamination request writing, patent license agreement writing, etc., which are specific legal or intellectual property work node affairs, which require the enterprise party and the service party to coordinate, communicate, cooperate and review the process affairs. According to the differences in these workflow types, the various node links required to complete these workflows are realized. These node links are obtained based on the training of the large model of AI, and then a reasonable and efficient transaction process is perfected, and the corresponding authorization content of the enterprise party and service party involved will be described in each transaction process, so that the rights of each party to authorize the processing of files, such as the processing time, can be clarified. Of course, each workflow node will also include the enterprise party, service party and their respective public key data involved in the node, so that their public keys can be directly obtained for encryption processing based on the authorization file.

[0038] In the first embodiment of the present invention, preferably, the description of the authorization content includes: whether the enterprise party and service party involved in each workflow node can encrypt and decrypt the workflow file; and / or the authorization duration of the workflow file in each workflow node; and / or whether the enterprise party and service party involved in each workflow node can initiate sub-authorization; and / or the configuration of the payment work node. The content in the authorization description in this embodiment can preferably be further increased according to the needs of the user, and then updated in the authorization file content generated in the server side of the workflow data protection system, so as to refer to it for execution during subsequent file encryption and decryption processing. For example, based on the request of the enterprise party, the business party will be further authorized to configure the payment node, so that the service party can pay the fee to the enterprise party.

[0039] In the first embodiment of the present invention, preferably, the official electronic letter content can be further obtained through the network interface; based on the identified official electronic letter content, a corresponding new workflow initiation request of the enterprise user is triggered; from a new workflow authorization file generated based on the workflow initiation request on the server side of the workflow data protection system, the public key data of the service provider of the current working node and the public key data of the enterprise user are obtained; an encryption factor is generated; based on the encryption factor, the work data of the enterprise user is encrypted to obtain ciphertext data; based on the enterprise user's public key, the above encryption factor is encrypted to obtain an encryption factor ciphertext data; based on the service provider's public key, the above encryption factor is encrypted to obtain another encryption factor ciphertext data; the above ciphertext data, the one encryption factor ciphertext data, and the another encryption factor ciphertext data are uploaded to the workflow data protection system server and stored in correspondence with the workflow authorization file; wherein the ciphertext data and the one encryption factor ciphertext data correspond to the enterprise user's public key in the workflow authorization file, and the ciphertext data and the another encryption factor ciphertext data correspond to the service provider's public key in the workflow authorization file. The one encryption factor ciphertext data and the other encryption factor ciphertext data mentioned above are two different encryption factor ciphertext data, which can be marked as, for example, the fifth and sixth encryption factor ciphertext data. In this embodiment, for further obtaining the incoming communication data from the official review opinions, etc., the AI ​​model tool can be used to identify the PDF file, and then trigger a corresponding new workflow initiation request of the enterprise user. This trigger is similar to the manual triggering of the enterprise user, except that it is triggered after the AI ​​model is recognized. This makes it convenient for enterprise users to use the AI ​​model tool on the client side to quickly and accurately initiate workflow requests. The AI ​​model tool in this embodiment is deployed, maintained and updated by the workflow data protection system server to support accurate identification of official electronic incoming communication content.

[0040] In the first embodiment, preferably, it further includes: sending the service completion information in the current workflow node to the workflow data protection system server; the workflow data protection system server detects that the next workflow node in the current workflow node in the workflow authorization file is the enterprise payment workflow node; settles the amount to be paid in the current workflow node; generates the link information that the enterprise can pay; encrypts the link information that the enterprise can pay according to the enterprise user public key to obtain the encrypted payment ciphertext data; sends the encrypted payment ciphertext data to the enterprise user client side; the enterprise user uses its enterprise user private key to decrypt the link information that the enterprise can pay and completes the payment. The workflow data protection system server pre-registers the service fee list with the service party, and there will be corresponding records of the amount of charges at different service nodes. When the workflow node is triggered to complete, the payment of the service fee between the enterprise and the service party can be completed through third-party payment channels such as Alipay, WeChat Pay, and digital RMB. It further includes the issuance and link provision of electronic bills. These schemes are all included in the conception of the present invention.

[0041] Embodiment 2: In order to more clearly reveal the specific composition of the authorization file generated by the workflow data protection system server in the present invention, a composition diagram of the authorization file is provided in the second embodiment of the present invention. Figure 2 A schematic diagram of the composition of the authorization file provided in Embodiment 2 of the present invention.

[0042] In the second embodiment, an example of an authorization file generated by a workflow data protection system server in response to a workflow for writing a patent application is disclosed. Figure 2 The patent application workflow authorization file 200 is shown. The patent application workflow authorization file 200 includes multiple work nodes: such as work node 1 patent briefing book writing and entrustment 201, work node 2 patent application draft writing 202, work node 3 patent application draft review 203, work node 4 patent application confirmation and instruction submission 204, work node 5 patent submission 205, and work node 6 patent fee payment 206. The patent application workflow includes the above-mentioned work nodes, which are established based on a complete work cooperation process. After learning by the AI ​​model, these work nodes can be automatically generated according to the request.

[0043] Relevant information in the workflow node: Each work node specifies the enterprise party (such as Company A) and the service party (such as Company B) involved, as well as their respective public key data. There is also the enterprise party's agent A1 user, and the service party B company's service user B1 user. The enterprise user here can be a user with the enterprise party as the main body, or a specific A1 user who is the legal agent of the enterprise party. Both can be understood as enterprise users, and are solutions within the scope of the present invention. This is the key basis for determining which public key to use for encryption and which private key to use for decryption in subsequent data encryption and decryption operations. For example, in the work node 201 for the writing and entrustment of the patent briefing book, the public key data of the enterprise party A company and the service party B company are recorded in the authorization file. When processing the data of this node, these public keys will be used to encrypt and process the workflow file accordingly.

[0044] At the same time, the patent application workflow authorization file 200 also contains a description of the corresponding authorization content of the enterprise party and the service party involved in each workflow node. This includes but is not limited to the following aspects: Enterprise party and service party information: clarify the basic information of each party for easy identification and management. Whether the workflow file can be encrypted and decrypted: specifies the operation rights of each party to the file in the workflow. For example, some nodes may only allow the enterprise party to encrypt and the service party to decrypt and view, but not allow the service party to encrypt, etc. The authorization duration of the workflow file: determines the allowed time for the effective authorization encryption and decryption of data in a specific node or the entire workflow. If this duration is exceeded, re-authorization or other processing may be required. Whether re-authorization can be initiated: If allowed, the service party or the enterprise party can transfer part of its authority to other parties under certain conditions, which increases the flexibility of workflow processing. Configuration of payment work nodes: For work nodes involving payment, detailed descriptions of payment-related rules, amount calculation methods, payment methods and other information are provided. For example, in the patent fee payment 206 of working node 6, the payment channel, the basis for fee calculation (not shown, the amount in the pre-signed service contract document) and the relationship with other working nodes (not shown, such as whether payment can only be made after a certain predecessor node is completed, etc.) will be clearly stipulated.

[0045] In the present invention, in addition to the patent application workflow authorization file 200, there may also be authorization files for other workflow affairs between the enterprise and the service provider involved in other patent agency services. The principle is similar to that of the second embodiment, and will not be repeated here. In addition, the workflows of other legal affairs are also similar to the authorization files in this embodiment and are also covered in the scope of the present invention.

[0046] Embodiment three: In order to more clearly disclose the workflow data processing system according to the present invention, Figure 3A schematic diagram of the framework of a workflow data processing system provided by Embodiment 3 of the present invention is shown in FIG.

[0047] The workflow data processing system in the third embodiment includes: an enterprise browser client 301 , a workflow data protection system server 302 , and a service browser client 303 .

[0048] The enterprise browser client 301 includes an SDK toolkit, which contains: Content display module 3011: displays workflow-related information to enterprise users, such as the progress of work nodes, authorization status, data content that needs to be processed, etc. It is presented to users in the form of an intuitive interface, which is convenient for users to understand the overall situation of the workflow and perform operations, and displays the decrypted workflow files, and is convenient for enterprise users to review and process. The trigger for initiating a request for the workflow can be set in this module. After the confirmation of the content authorization module 3013, this module can use the encryption and decryption content module 3012 to display the decrypted content. If the content authorization conditions are not met, for example, the authorization time has passed, the decryption operation cannot be performed.

[0049] The encryption and decryption content module 3012 is responsible for obtaining the public key data of the service provider of the current working node and the public key data of the enterprise user from the workflow data protection system server 302; generating an encryption factor, and encrypting the working data of the enterprise user according to the encryption factor to obtain ciphertext data, and encrypting the encryption factor according to the enterprise user public key to obtain the first encryption factor ciphertext data; and encrypting the encryption factor according to the service provider public key to obtain the second encryption factor ciphertext data, uploading the ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data to the workflow data protection system server 302 and saving them in correspondence with the authorization file of the workflow where the current working node is located, so that the ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data at the current node can be found according to the authorization file, so that these ciphertext data can be obtained during the later decryption. For example: the enterprise party at the current node in the authorization file can record the storage path information of the ciphertext data and the first encryption factor ciphertext data uploaded by it, and save them in correspondence with the enterprise party public key of the authorization file. For example, the storage path information of the uploaded ciphertext data and the second encryption factor ciphertext data can be recorded at the service side at the current node in the authorization file, and saved corresponding to the service side public key of the authorization file. These saves are processed in the workflow data protection system server 302. At the same time, it is also used to obtain the ciphertext data and encryption factor ciphertext data corresponding to the enterprise side public key at the current working node from the workflow data protection system server 302, and use the enterprise side's private key to perform decryption operations on the enterprise side client.

[0050] Content authorization module 3013: manages enterprise users' authorization-related matters of file data in the workflow. It interacts with the workflow data protection system server to perform operations such as applying for authorization, checking the authorization scope, and updating the confirmation management of the authorization content, and coordinates with the presentation content module 3011, the encryption and decryption content module 3012, and the authorization content update module 3014.

[0051] Authorization content update module 3014: When an enterprise user needs to update the authorization content of a workflow node (such as changing the service provider, adjusting the authorization duration, changing the payment channel, etc.), this module is responsible for initiating a request and coordinating with the workflow data protection system server to complete the update operation.

[0052] Preferably, the authorization content update module 3014 is further configured to include a workflow adaptive adjustment module (not shown). During the execution of the workflow, the enterprise browser client continuously monitors the workflow status (such as data upload and download speed, service party processing progress, official communication response time, etc.) and external environment changes (such as legal and regulatory updates, industry technology breakthroughs, etc.) through the monitoring tool 3015. When it is found that the actual situation deviates from the pre-planned path or the external environment changes significantly, the workflow adaptive adjustment mechanism is automatically triggered. The adjustment mechanism is based on a dynamic programming algorithm, recalculates the priority, resource allocation and time arrangement of each node in the workflow, and requests the workflow data protection system server 302 to update the authorization file content to implement the above adjustment mechanism. For example, if a service party is significantly behind in the progress of the patent application draft writing node, the system will automatically evaluate whether it is necessary to increase resources (such as allocating more manpower or extending the authorization time) or adjust the order of subsequent nodes (such as conducting part of the review work first while waiting for the draft to be completed) to ensure that the efficiency and quality of the entire workflow are not affected.

[0053] Monitoring tool 3015: monitors the status of workflow in real time, including the upload and download progress of enterprise users' work file data, server connection status, execution status of work nodes, editing time in work files, etc., and feeds this information back to AI module 3016 or workflow data protection system server, and after analysis, it is displayed to enterprise users or service users for viewing, so that users can promptly understand whether the workflow is running normally and the user's processing status, thereby increasing transparency.

[0054] AI module 3016: Use artificial intelligence technology to analyze the data collected by monitoring tool 3015 in a large model, such as intelligently analyzing the work data of enterprise users, predicting possible problems in the workflow or providing optimization suggestions, and assisting enterprise users to better manage workflows. This module communicates with the workflow data protection system server 302 to update and manage the parameters of its AI model, synchronize with the AI ​​server on the server side, and then realize edge AI computing on the client to meet the fast AI computing of enterprise users on the client, and communicate and synchronize the calculation results with other modules and the workflow data protection system server.

[0055] Preferably, the AI ​​module 3016 is further configured to include a big data analysis module (not shown), which obtains enterprise user data through the monitoring tool 3015 for analysis and processing. For example, before the enterprise user initiates the workflow, the big data analysis module collects the enterprise's internal historical workflow data, similar business workflow cases in the same industry, and market trend information. Through in-depth analysis of these data, the problems and bottlenecks that may be encountered in this workflow are predicted, and the optimal workflow path opinions are planned in advance, and sent to the workflow data protection system server 302 synchronously. For example, in the patent application workflow, according to the average time consumption, success rate and possible types of examination opinions of different types of patent applications at each node in the historical data, a personalized workflow plan is formulated for the current application, including recommending a suitable service provider, estimating the completion time of each node, etc. The big data analysis module (not shown) further uses machine learning algorithms to learn the business model and work habits of enterprise users, and automatically identifies key decision points and optimizable links in the workflow. For example, if an enterprise often applies for patent combination, the system will identify the pattern and automatically arrange relevant patent search and analysis nodes during workflow pre-planning to improve the quality and success rate of the patent combination.

[0056] Preferably, the AI ​​module 3016 is further configured to include an intelligent workflow assistant module (not shown), which uses natural language processing (NLP) and machine learning technology to provide real-time workflow guidance and prompts for enterprise users. Users can interact with the intelligent assistant through voice or text to ask any questions about the workflow, such as the next operation of the current node, the list of materials to be submitted, the estimated completion time, etc. The intelligent assistant provides users with personalized suggestions and solutions based on the real-time status of the workflow, the user's historical operation records, and the best practice cases in the knowledge base. For example, in the patent application process, when the user asks whether the patent application conditions are met, the intelligent assistant will analyze the type and key points of the consultation question, and combine the company's past similar cases and common industry response strategies to generate detailed response ideas and reference material lists for the user. Further, the intelligent workflow assistant module predicts possible risk events in the workflow, such as the risk of patent application rejection, service provider default risk, data leakage risk, etc., through real-time analysis and learning of workflow data. It is based on the risk assessment model, comprehensively considering multiple factors such as the progress of workflow nodes, official policy changes, and service provider credit records, and calculates the risk probability and impact. When the risk probability exceeds the preset threshold, the intelligent assistant sends warning information to the enterprise user, including the risk type, possible impact range, recommended countermeasures, etc. For example, if it is predicted that a patent application may be rejected due to insufficient comparative analysis of prior art, the intelligent assistant will remind the user to supplement relevant technical information in a timely manner or consider adjusting the application strategy, and provide specific operational guidance and resource recommendations (such as recommending professional patent search services or technical expert consultation).

[0057] The workflow data protection system server 302 includes: a user server 3021, a content encryption and decryption server 3022, a workflow authorization file server 3023, and an AI server 3024.

[0058] The user server 3021 includes: a user identity authentication module 30211, a user status supervision module 30212, a user public key escrow module 30213, an encrypted content management module 30214, and an authorization file management module 30215. The user identity authentication module 30211 verifies the binding identity of the enterprise user and the service user, as well as their corresponding handlers or service personnel, to determine that they are the corresponding enterprise users or service users; and collects the user status monitoring data from the monitoring tool 3015 and the monitoring tool 3034 and the analysis results of the AI ​​module 3015 and the AI ​​module 3035 through the user status supervision module 30212, performs data management, and provides data for the subsequent AI server 3023; the user public key escrow module 30213 specifically manages and saves the public keys of serious users. Because the public keys are used in many situations, the user public key escrow module 30213 is specially set to manage and save the public keys uploaded by the user client side. The encrypted content management module 30214 is configured to manage the encrypted content uploaded by the user side, and to provide storage address information for the encrypted content to be used in the subsequent encrypted content storage module 30221, the authorization file template library 30231, etc., so as to facilitate access; the workflow authorization file management module 30215 is used to communicate and manage the workflow and authorization files in the subsequent workflow authorization file service 3023, so as to facilitate users to access the content therein, and receive user requests for updates, etc., so as to perform management operations such as update processing in the workflow authorization file service 3023; The content encryption and decryption server 3022 includes: an encrypted content storage module 30221, which stores the ciphertext data, encryption factor ciphertext data, etc. uploaded by the enterprise user or the service user. These storages are stored in correspondence based on the user public key. For example, the ciphertext data and the encryption factor ciphertext data are stored in correspondence with the enterprise user public key. For example, the ciphertext data and the encryption factor ciphertext data are stored in correspondence with the service public key, and are stored in correspondence with the workflow authorization file in the workflow authorization file service 3023. The above corresponding storage can be maintained through a table in a database to achieve this corresponding relationship, and it is also convenient to query and call access. In addition, the content encryption and decryption server 3022 also includes an encrypted content authorization module 30222, which is convenient for the enterprise user to authorize the encrypted content to different service users. This authorization requires the enterprise user to apply for the public key of the service user to be authorized, and use the public key to encrypt the encryption factor, so that the authorized user can use its private key to decrypt and obtain the encryption factor, so that the encrypted factor can be used to decrypt the work file, thereby realizing the authorization or transfer authorization processing.

[0059] Preferably, .

[0060] The workflow authorization file server 3023 includes: an authorization file template library 30231, an authorization description content generation module 30232, a workflow generation module 30233, and a payment server 30234. The authorization file template library 30231 stores the generated authorization files for common workflows, such as the authorization file module for writing patent applications mentioned in the first embodiment. The module also receives the content generated by the authorization description content generation module 30232 and the workflow generation module 30233, which can be stored for use after review and confirmation. For example, the authorization description content generation module 30232 and the workflow generation module 30233 generate a corresponding authorization file required to complete a user-specific workflow. Preferably, the authorization description content generation module 30232 and the workflow generation module 30233 can also receive data from the AI ​​server 3024, and generate corresponding workflow nodes or authorization description content according to the optimized workflow node design scheme of the AI ​​server. For example, the processing time of the work file of the enterprise user analyzed by the enterprise user data collection and analysis module 30241 needs to be dynamically adjusted, so that the authorization description content generation module 30232 can adjust the parameter content in its authorization file; preferably, the authorization description content generation module 30232 and the workflow generation module 30233 can also receive the intelligent workflow allocation data pushed by the AI ​​server 3024, which includes the workflow generated according to the workflow type, and the information of the matching service party that can efficiently complete the task in the workflow. These AI-generated matching service party information can be determined by the enterprise user after the final selection to form the final workflow authorization file. Preferably, if there is a payment node in the node of the workflow, and the payment needs to be completed before proceeding to the next node, the payment will be completed in the payment server 30234.

[0061] Preferably, the payment server 30234 is configured to ensure that the enterprise and the service provider use secure multi-party computing (MPC) to jointly calculate certain key indicators or perform data processing in the workflow without disclosing the privacy of their respective user data. For example, in the process of calculating patent fees, the enterprise and the service provider can jointly calculate the accurate fee amount based on pre-set rules and the data they have (such as service duration, service type, contract terms, etc.) without disclosing sensitive data to other parties. Through the MPC protocol, the enterprise browser client can conduct secure data interaction and computational collaboration with other participants. During the calculation process, the data always exists in encrypted form, and only the final calculation result is decrypted and displayed under the authorization conditions, which effectively protects the data privacy and business secrets of all parties and ensures the smooth completion of payment.

[0062] Preferably, the workflow generation module 30233 further includes a workflow data blockchain storage module (not shown), which is configured to store the generated workflow key data (such as workflow initiation requests, data encryption records, service provider selection and change records, payment records, etc.) on the blockchain. The distributed ledger characteristics of the blockchain ensure that the data cannot be tampered with and is traceable, and provide reliable records for the entire life cycle of the workflow. The data of each workflow node is packaged into a block, containing the hash value, timestamp, data content and other information of the previous block, forming a chain structure. In this way, any tampering with the workflow data will be detected by the nodes in the blockchain network, ensuring the authenticity and integrity of the data. At the same time, enterprise users, service providers, and regulatory agencies can query and verify the historical records of the workflow at any time, enhancing the transparency and trust of the workflow.

[0063] Preferably, the workflow generation module 30233 further includes a smart contract driven workflow automation module (not shown), which is configured as a blockchain-based smart contract for automatically executing some rules and processes in the workflow. For example, in the process of selecting a service provider, the enterprise user can set selection criteria and conditions (such as service provider qualifications, historical evaluation, quotation range, etc.) through the smart contract, and the smart contract automatically screens qualified service providers and sorts and recommends them according to preset rules. Once the enterprise user confirms the selection, the smart contract automatically executes operations such as service provider signing and workflow authorization, reducing human intervention and improving workflow efficiency. Further, the workflow generation module 30233 is configured to use smart contracts to realize the automatic audit function of the workflow. During the execution of the workflow, the smart contract monitors in real time whether the operations of each node comply with the pre-set rules and processes (such as data encryption requirements, authorization scope restrictions, payment conditions, etc.). If a violation is found, the smart contract automatically triggers the early warning mechanism and records a detailed audit log to provide a basis for subsequent responsibility tracing and problem handling. At the same time, the smart contract can also regularly generate workflow audit reports for review by enterprise management and regulatory agencies to ensure the compliance and standardization of the workflow.

[0064] Among them, the AI ​​server 3024 includes: an enterprise user data collection and analysis module 30241, a service agency user data collection and analysis module 30242, and an intelligent workflow allocation module 30243. The AI ​​server 3024 deploys and runs an AI large model for processing enterprise user data and service agency user data, generating state analysis parameters for enterprise users and service agency users, so as to complete the automatic allocation of the service party involved in the current working node in the workflow in the intelligent workflow allocation module 30243, thereby further completing the generation of the workflow authorization file. As a server background, the AI ​​server 3024 also performs parameter updates and structural optimization for the AI ​​modules in the enterprise browser client 301 and the service browser client 303, and can also perform allocation and collaborative calculation of analysis tasks.

[0065] The service browser client 301 includes an SDK toolkit, which contains: Display content module 3031: Displays workflow related information to service users, such as the progress of work nodes, authorization status, data content to be processed, etc. It is presented to users in an intuitive interface form, which is convenient for users to understand the overall situation of the workflow and operate it, and displays the decrypted workflow files, and is convenient for service users to process work files. After the confirmation of the content authorization module 3033, this module can use the encryption and decryption content module 3032 to display the decrypted content. If it does not meet the content authorization conditions, such as the authorization time has passed, the decryption operation cannot be performed. Preferably, in the service browser client 303, the displayed content will also have a workflow generation module 30234 to give the introduction content of the workflow node that the service party who needs to be assigned the work node can view in the workflow node, and after confirming to participate in the workflow node, the encryption factor ciphertext data and the corresponding ciphertext data encrypted using the service party's public key can be downloaded, so that subsequent decryption operations can be performed, and then participate in the workflow node.

[0066] The encryption and decryption content module 3032 is responsible for obtaining the public key data of the service provider of the current working node and the public key data of the enterprise user from the workflow data protection system server 302; generating an encryption factor, and encrypting the work data of the service provider user according to the encryption factor to obtain ciphertext data, and encrypting the encryption factor according to the enterprise user public key to obtain the first encryption factor ciphertext data; and encrypting the encryption factor according to the service provider public key to obtain the second encryption factor ciphertext data, uploading the ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data to the workflow data protection system server 302 and saving them in correspondence with the authorization file of the workflow where the current working node is located, so that the ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data at the current node can be found according to the authorization file, so that these ciphertext data can be obtained during the later decryption. For example: the enterprise at the current node in the authorization file can record the storage path information of the ciphertext data and the first encryption factor ciphertext data uploaded by it, and save them in correspondence with the enterprise public key of the authorization file. For example, the storage path information of the uploaded ciphertext data and the second encryption factor ciphertext data can be recorded at the service side at the current node in the authorization file, and stored correspondingly with the service side public key of the authorization file. These storages are all processed in the workflow data protection system server 302. At the same time, it is also used to obtain the ciphertext data and encryption factor ciphertext data corresponding to the service side public key at the current working node from the workflow data protection system server 302, and use the service side's private key to perform decryption operations on the service side client.

[0067] Content authorization module 3033: manages the authorization-related matters of file data of service-side users in the workflow. It interacts with the workflow data protection system server to perform operations such as applying for authorization to view work files authorized by the enterprise and viewing the authorization scope, and coordinates with the content presentation module 3031 and the encryption and decryption content module 3032.

[0068] Monitoring tool 3034: monitors the status of the workflow in real time, including the upload and download progress of the service user's work file data, the server connection status, the service node's service execution status, the editing time in the work file, etc., and feeds this information back to the AI ​​module 3035 or the workflow data protection system server, and after analysis, it is displayed to the enterprise user or the service user, so that users can promptly understand whether the workflow is running normally and the user's processing status, thereby increasing transparency.

[0069] AI module 3035: Use artificial intelligence technology to perform large-scale model analysis on the data collected by monitoring tool 3034, such as intelligent analysis of the work data of service users, predicting possible problems in the workflow or providing optimization suggestions, and assisting the workflow to execute more smoothly. This module communicates with the workflow data protection system server 302 to update and manage the parameters of its AI model, synchronize with the AI ​​server on the server side, and then realize edge AI computing on the client to meet the fast AI computing of service users on the client side, and communicate and synchronize the calculation results with other modules and the workflow data protection system server.

[0070] Embodiment 4: To more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a fourth embodiment to illustrate the interactive process of the enterprise user's public and private key generation process when the enterprise user initiates a workflow for the first time in the third embodiment of the present invention. Figure 4 , Figure 4 This is a schematic diagram of the interactive process of generating public and private keys of an enterprise user when the enterprise user initiates a workflow for the first time in the third embodiment of the present invention.

[0071] The following is a disclosure of the public and private key generation process when an enterprise user initiates a workflow for the first time in Example 4: When an enterprise user opens a workflow management application (such as the intellectual property service-related APP mentioned above) for the first time and prepares to initiate a workflow, the monitoring tool on the enterprise client (such as a specific monitoring module in the SDK) starts working to determine whether the enterprise user has triggered the workflow initiation request for the first time. If it is determined to be the first time, the client will start the public and private key generation mechanism.

[0072] There are many options for generating public and private keys. One way is to obtain them from a third-party public and private key pair provider (such as a digital certificate authority CA) and obtain the public and private key pair for an asymmetric encryption algorithm (such as the RSA algorithm) through its network service interface. Another way is to use the asymmetric encryption algorithm provided by the client SDK to generate a public and private key pair. This method ensures that enterprise users can quickly obtain the public and private key pair, and it has certain convenience and security.

[0073] Assume that the generated enterprise user public key is K and the private key is S. After generation, the enterprise user private key S will be securely stored locally on the client, such as in the browser cache or in an encrypted storage area locally on the client, to ensure that the private key is only controlled by the enterprise user himself, effectively protecting the security of the data. The enterprise user public key will be uploaded to the workflow data protection system server through a secure network connection for storage, so that it can be used for subsequent data encryption and / or decryption operations in the workflow. In this fourth embodiment, after the workflow data protection system server receives the public key uploaded by the enterprise user, it will save it in correspondence with the enterprise user's unique identifier (such as an enterprise registration number or user name), establish an association between the enterprise user identity and the public key, and lay the foundation for subsequent identity authentication and data processing.

[0074] Preferably, at the same time, the server is ready to verify the identity of the enterprise user. The server uses the public key K of the enterprise user to encrypt a randomly generated random string to generate an encrypted verification code. This random string is generated by a specific random number generator or a function in a programming language on the server, and has sufficient randomness and unpredictability to ensure the security of the verification process. Then, the server sends the encrypted verification code back to the enterprise user client through a secure network connection. After the enterprise user client receives the encrypted verification code sent by the server, it uses the locally stored enterprise user private key S to decrypt it to obtain the original random string. Then, the client sends the decrypted random string back to the workflow data protection system server through the network. After receiving the random string returned by the enterprise user client, the server compares it with the original random string generated previously. If the two are consistent, the server confirms that the identity of the enterprise user is legal and completes the identity verification process. At this time, the server will generate and set corresponding information for the enterprise user in the authorization description of the workflow authorization file, such as recording the permissions of the enterprise user, operable workflow nodes and other information, to provide accurate authorization basis for subsequent workflow processing. If the two are inconsistent, there may be an identity authentication failure. The server can take corresponding measures according to the preset security policy, such as rejecting the enterprise user's access request, issuing a security alert, etc., to ensure the security of the system.

[0075] Embodiment five: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a fifth embodiment to illustrate the workflow process of the enterprise user encryption processing in the third embodiment of the present invention. Figure 5 , Figure 5 This is a workflow diagram of encryption processing for enterprise users in Embodiment 3 of the present invention.

[0076] The following is the interaction process in Example 5: The enterprise user triggers a workflow initiation request on the enterprise client. In daily business operations, the enterprise user determines to start a specific workflow based on actual needs, such as preparing to apply for a new patent in the field of intellectual property services. The enterprise user opens the workflow client application pre-installed on his device (such as a computer, tablet or smartphone). On the operation interface of the application, the enterprise user finds the function entrance related to patent application, such as the "Patent Application Workflow" button. After clicking the button, the application sends a request message containing specific identifiers and parameters to the workflow data protection system server through a pre-configured network communication protocol (such as the HTTPS protocol), thereby triggering the enterprise user's workflow initiation request. This request message contains the enterprise user's unique identifier (such as the enterprise registration number or user name), request timestamp, workflow type identifier (here is the patent application workflow) and other information, so that the server can accurately identify and process the request.

[0077] The workflow data protection system server generates an authorization file and provides public key data. After the workflow data protection system server receives the workflow initiation request from the enterprise user, it selects the corresponding template from the predefined workflow template library according to the workflow type identifier in the request (such as patent application workflow). For example, the patent application workflow template may contain multiple standard workflow nodes, such as patent briefing writing, patent search, application document preparation, application submission, review and reply, etc. Then, the server generates a workflow authorization file (set as authorization file) based on the template. During the generation process, the server determines the information of the parties involved in the workflow (enterprise users and service providers), and obtains the public key data of each party accordingly. Assuming that the current working node is the writing of patent briefing, the server determines the first service provider involved in the node (such as the patent agency intelligently assigned by AI server 3024), obtains its public key data, and obtains the public key data previously uploaded by the enterprise user and stored on the server. The server side stores the generated workflow authorization file X1 (including workflow node information, public key data of all parties, authorization content description, etc.) in the authorization file server, and returns the service party public key data K2 and enterprise user public key K1 data of the current working node to the enterprise user client through a secure network connection. After receiving the public key data, the enterprise user client stores it in the local memory or secure storage area for subsequent encryption operations.

[0078] The enterprise client generates the encryption factor. This production is achieved through the enterprise client SDK. After the enterprise user client receives the public key data returned by the server, it uses the preset algorithm in its built-in SDK toolkit to generate the encryption factor a. For example, a random number generation algorithm based on cryptographic security is used, combined with the current system time, client device identification and other information, to generate an encryption factor with sufficient randomness and security through complex mathematical operations. Assume that the generated encryption factor is 128 bits (this length can be adjusted according to actual security requirements).

[0079] The enterprise user prepares to upload work data A (work data includes any type of data in text, picture, audio, video, or specified format data, depending on the actual service needs), and uses the generated encryption factor a to encrypt the work data A. Taking the common AES encryption algorithm as an example, the work data is divided into fixed-length data blocks (such as 128 bits), and each data block is XORed with the encryption factor to obtain the encrypted ciphertext data block, and finally generates the encrypted ciphertext data A1. Client encryption encryption factor (using the enterprise user public key): The enterprise user client uses the enterprise user public key K1 to encrypt the encryption factor a. The calculation process involves the modular exponentiation operation in the public key encryption algorithm (such as the RSA algorithm), that is, (where is the encrypted encryption factor ciphertext data, is the encryption exponent in the public key, and is the modulus in the public key), and obtains the first encryption factor ciphertext data B1. Client encryption encryption factor (using the service provider public key): The enterprise user client also uses the service provider public key K2 to encrypt the encryption factor a, and calculates the second encryption factor ciphertext data B2 according to the public key encryption algorithm. The calculation method is similar to encryption using the enterprise user's public key K1, and is implemented through the corresponding modular exponentiation operation to ensure that the encryption factor a is securely encrypted so that the service provider can subsequently decrypt and obtain it.

[0080] The enterprise client uploads the ciphertext data A1 and the encryption factor ciphertext data B1 and B2 to the server. The enterprise client uploads the encrypted ciphertext data A1, the first encryption factor ciphertext data B1, and the second encryption factor ciphertext data B2 to the workflow data protection system server. On the server, these data will be saved in correspondence with the previously generated workflow authorization file X1. Specifically, the ciphertext data A1 and the first encryption factor ciphertext data B1 correspond to the enterprise user public key K1 in the workflow authorization file, and the ciphertext data A1 and the second encryption factor ciphertext data B2 correspond to the service party public key K2 in the workflow authorization file. This corresponding storage method makes it convenient to accurately find the corresponding ciphertext data and encryption factor ciphertext data according to the public key for decryption operations when needed, ensuring that the storage and management of workflow data on the server side are well organized and secure.

[0081] Embodiment six: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a sixth embodiment to illustrate the workflow process of the enterprise user decryption processing in the third embodiment of the present invention. Figure 6 , Figure 6 This is a workflow diagram of the decryption process for enterprise users in Embodiment 3 of the present invention.

[0082] The following is the interaction process in Example 6: Enterprise users trigger work data decryption and viewing requests: During the workflow process, when enterprise users need to view or process encrypted uploaded work data, they find the corresponding decryption and viewing function entry in the enterprise client application (such as the various client forms mentioned above), such as the "View Patent Application Documents" button. Clicking this button triggers a decryption and viewing request for the enterprise user's work data. This request will be sent to the workflow data protection system server through a network communication protocol (such as the HTTPS protocol). The request contains the enterprise user's identity, the requested workflow node information, and related operation instructions, so that the server can accurately identify the enterprise user's intention and perform corresponding processing.

[0083] The server verifies the authorization conditions: After the workflow data protection system server receives the decryption and viewing request from the enterprise user, it first obtains the corresponding workflow authorization file X1 based on the identity of the enterprise user. Then, the server checks the authorization content description of the current workflow node and the enterprise user in the authorization file X1 to determine whether the enterprise user meets the authorization conditions. For example, check whether the enterprise user has the decryption and viewing permission at the workflow node, whether it is within the authorized time range, and whether other relevant authorization rules are met (such as whether the pre-operation has been completed, etc.). If the enterprise user meets the authorization conditions, the server is ready to provide the enterprise user with the data required for decryption; if it does not meet the authorization conditions, the server will reject the enterprise user's decryption request and return the corresponding error message to the enterprise user according to the preset security policy, such as "insufficient authority" or "authorization period has expired".

[0084] The workflow data protection system server provides the public key, ciphertext data and encryption factor ciphertext data: When the workflow data protection system server determines that the enterprise user meets the authorization conditions, it obtains the ciphertext data A1 of the enterprise user's work data A in the current workflow node and the first encryption factor ciphertext data B1 corresponding to the enterprise user's public key K1 from the location where the encrypted data is stored (such as the encrypted content storage module 30221 in the content encryption and decryption server 3022) according to the relevant information of the enterprise user's public key K1 recorded in the workflow authorization file X1. Then, the server sends the enterprise user's public key K1, ciphertext data A1 and the first encryption factor ciphertext data B1 back to the enterprise user client through a secure network connection to ensure the security of the data during transmission and prevent it from being stolen or tampered with.

[0085] The enterprise user client obtains the private key and decrypts the encryption factor ciphertext data: After the enterprise user client receives the ciphertext data A1 and the first encryption factor ciphertext data B1 sent by the server, it obtains the enterprise user private key S from the local secure storage area (such as the browser cache or the client's local encrypted storage area). Then, the enterprise user private key S is used to decrypt the first encryption factor ciphertext data B1. According to the inverse operation of the public key encryption algorithm (such as the RSA algorithm), (where is the decryption exponent in the private key) is calculated to obtain the encryption factor a. This process realizes the restoration of the original encryption factor from the encrypted encryption factor ciphertext data, laying the foundation for the subsequent decryption of the working data.

[0086] The enterprise client uses the encryption factor to decrypt the work data: After obtaining the encryption factor a, the enterprise client uses the encryption factor a to decrypt the ciphertext data A1. Taking the algorithm used in the previous encryption (such as the AES algorithm) as an example, each data block of the ciphertext data A1 is XORed with the encryption factor again to restore the original work data A. At this time, the enterprise user can view, edit, and process the decrypted work data to meet their business needs in the workflow. For example, in the patent application workflow, enterprise users can view and modify the content of the patent briefing, add new technical information, etc.

[0087] After the enterprise user processes the work data, it re-encrypts and uploads it (if there is an update): After the enterprise user processes the work data A, if the work data A is updated (such as modifying part of the content or adding a new file), new work data is generated. At this time, the enterprise user client will regenerate new ciphertext data A1', and its generation method is the same as the generation method of the previous ciphertext data A1, that is, the encryption factor a' (the generation method of the encryption factor a' here is the same as the generation method of the previous encryption factor a, if the encryption factor is not updated, it is still the previous encryption factor a) is used to encrypt the generated new work data. In addition, the enterprise user client will regenerate the encryption factor ciphertext data B1' and the encryption factor ciphertext data B2', and its generation method is the same as the generation method of the previous encryption factor ciphertext data, that is, the enterprise user public key K1 and the service provider public key K2 are used to encrypt the encryption factor a' (the generation method of the encryption factor a' here is the same as the generation method of the previous encryption factor a, if the encryption factor is not updated, it is still the previous encryption factor a). Then, the enterprise user client uploads the new ciphertext data A1' processed by the encryption factor a', the newly generated encryption factor ciphertext data B1' and the encryption factor ciphertext data B2' to the workflow data protection system server. After receiving these data, the server will replace or update the new data with the original data according to the corresponding relationship in the workflow authorization file X1, that is, K1 corresponds to A1' and B1', and K2 corresponds to A1' and B2'; ensure the consistency and security of the workflow data, and at the same time ensure that the service provider can obtain the latest work data in subsequent operations.

[0088] Embodiment seven: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a seventh embodiment to illustrate the workflow process of the enterprise user changing the service provider in the third embodiment of the present invention. Figure 7 , Figure 7 This is a workflow diagram of an enterprise user changing a service provider in Embodiment 3 of the present invention.

[0089] The following is the interaction process in Example 7: Enterprise users obtain current service provider information: When an enterprise user needs to change the service provider involved in the current workflow node during the workflow process, he or she first sends a request to obtain the service provider information involved in the current workflow node to the workflow data protection system server through the enterprise client application (such as the various client forms described above). This request contains information such as the enterprise user's identity, workflow-related identifiers, and request timestamp, so that the server can accurately identify and process the request. After receiving the request, the server obtains the service provider information involved in the current workflow node (such as the service provider name, service provider public key, service provider contact, etc.) from the stored workflow authorization file X1 based on the enterprise user's identity and workflow information, and returns this information to the enterprise user client.

[0090] Enterprise users initiate service provider information update request: After the enterprise user client receives the service provider information of the current workflow node returned by the workflow data protection system server, a corresponding interface is provided in the client application for the enterprise user to initiate an update request for the service provider information involved in the current workflow node. The client will update the request information including the enterprise user identity, workflow node identity, update reason, etc.

[0091] Obtaining the description information of the service providers that can be selected: After the enterprise client receives the service provider information update request from the enterprise user, it obtains the description information of the service providers that can provide similar services from the workflow data protection system server (process arrows not shown) according to the workflow type and business needs. This information includes the name, qualifications, service scope, historical service evaluation, etc. of the service provider, so that the enterprise user can fully understand the situation of the service providers that can be selected. The workflow data protection system server organizes the description information of these service providers into a list and sends it back to the enterprise user client through the network (process arrows not shown).

[0092] Enterprise users select a new service provider: After the enterprise user client receives the selectable service provider description information sent by the server, it is displayed to the enterprise user in the application. The enterprise user selects the second service provider from the list based on its own needs and evaluation of the service provider. For example, the enterprise user may make a comprehensive consideration of factors such as the service provider's historical service evaluation, professional field matching, price, etc., and select the service provider that best suits the current workflow needs. After the enterprise user selects the second service provider on the client side, it initiates a request to the server to update the service provider of the current workflow node, which contains the information of the second service provider.

[0093] The server updates the service provider information in the authorization file: After the workflow data protection system server receives the second service provider information selected by the enterprise user, it updates the service provider information of the current workflow node in the workflow authorization file X1 to the second service provider information. The specific operation includes replacing the original service provider related information (such as name, public key, contact person, etc.) in the authorization file with the corresponding information of the newly selected second service provider. At the same time, the server obtains the public key of the second service provider to prepare for subsequent data encryption and decryption operations.

[0094] The enterprise client encrypts the encryption factor (using the new service provider public key) and uploads the relevant data: The enterprise user client uses the obtained second service provider public key K3 to encrypt the encryption factor a in the current workflow (the encryption factor a previously generated and used in the workflow, if the same encryption factor a is still required in subsequent nodes), and the calculation method is similar to the previous encryption using other public keys to obtain the third encryption factor ciphertext data B3. Then, the client uploads the ciphertext data A1 of the current workflow node (the ciphertext data A1 previously uploaded and stored on the server, if the work data has not been updated) and the third encryption factor ciphertext data B3 to the workflow data protection system server. On the server side, these data will be saved in correspondence with the updated workflow authorization file X1, where K3 corresponds to A1 and B3, ensuring that when the new service provider participates in the workflow, the corresponding ciphertext data and encryption factor ciphertext data can be accurately found according to the public key for decryption operations, ensuring the security and continuity of the workflow data after the service provider is changed.

[0095] Preferably, in this embodiment, a corresponding interface is provided in the client application for the enterprise user to initiate an update request for the service party information involved in the current workflow node. Before initiating the update request for the service party information involved in the current workflow node, it further includes: obtaining the service completion status information of the service party involved in the current workflow node; pre-judging the quality parameters of the service party completing the service based on the service completion status information; and sending the quality parameters of the service workflow to the enterprise user client side. In this preferred solution, the service completion status information of the service party involved in the current workflow node can be used to predict its service quality information, and then fed back to the enterprise user client side, so as to facilitate the enterprise party to better understand the service quality and status of the service party, and to determine whether to initiate an update request for the service party information. The service completion status information of the service party involved in the current workflow node is preferably completed in the monitoring tool 3034, and then the status information is processed in the AI ​​module 3035 or the service agency user data collection and analysis module 30242 in the AI ​​server 3024 for distributed analysis tasks, so as to obtain the service quality and status of the service party, and then fed back to the enterprise user client side to display these service quality and status information.

[0096] Embodiment eight: To more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses an eighth embodiment to illustrate the process of the enterprise user completing the current working node and starting the next node in the third embodiment of the present invention. Figure 8 , Figure 8 This is a flow chart of the process of an enterprise user completing the current working node and starting the next node in the third embodiment of the present invention.

[0097] The following is a disclosure of the interaction process in Example 8.

[0098] Send service completion information: After completing all work tasks of the current work node, the enterprise user sends service completion information to the workflow data protection system server through the SDK toolkit in the enterprise browser client. This information contains the enterprise user's unique identifier, the completed work node identifier, and the completion timestamp, etc., to ensure that the server can accurately identify and record that the node has been completed. For example, in the patent application process, after the enterprise user completes the writing of the patent briefing and the entrustment node, the service completion information containing the enterprise user ID number, the node identifier, and the completion time is sent.

[0099] The server side checks data upload and authorization status: After the workflow data protection system server side receives the service completion information, it first checks whether the ciphertext data and encryption factor ciphertext data in the current working node have been uploaded by the enterprise and / or the service party. The server side confirms the storage status of the relevant data by querying the encrypted content storage module in the content encryption and decryption server. At the same time, check whether the corresponding authorization content of the enterprise and service party involved in the current workflow node in the first workflow authorization file complies with the description of the authorization status. For example, check whether the enterprise has the correct encryption operation at the node, whether the service party has the corresponding decryption viewing authority, and whether the authorization rules are met. If it is found that the data is not fully uploaded or the authorization status is inconsistent, the server side will return an error prompt to the enterprise user client, requiring the enterprise user to check and supplement the relevant data or deal with the problem of non-compliance with the authorization.

[0100] Obtain the service provider information of the next workflow node: When the workflow data protection system server confirms that the data upload and authorization status are correct, obtain the third service provider information involved in the next workflow node of the current workflow node according to the workflow node design in the workflow authorization file X1. Preferably, for example, the server searches for the service provider information of the next node from the authorization file template library in the workflow authorization file server or the generated workflow authorization file X1, including the service provider name, service provider public key, etc. For example, if the current node is the completion of the draft of the patent application, and the next node is the review of the draft of the patent application, the server obtains the service provider information responsible for the review.

[0101] Update workflow authorization file and node information: The workflow data protection system server updates the current workflow node in the first workflow authorization file X1 in the workflow data protection system server to the next workflow node, and updates the service provider information therein to the third service provider information. At the same time, update the node status, authorization content and other related information in the workflow authorization file to ensure that the authorization file is consistent with the actual workflow progress. For example, in the authorization file, update the node status from "in progress" to "completed", and set new authorization duration and permission rules for the next review node.

[0102] Send the third-party service provider's public key to the enterprise user client: The workflow data protection system server sends the obtained third-party service provider's public key K4 to the enterprise user client. Through a secure network connection, the confidentiality and integrity of the public key transmission process are ensured. After receiving the public key, the enterprise user client stores it in the local memory or secure storage area to prepare for subsequent encryption operations. For example, in the process of submitting a patent application after it is written, the public key of the patent application service provider is sent to the enterprise user. After the enterprise user completes the review, the third-party service provider's public key K4 is used to encrypt the relevant data, so that the subsequent patent application service provider can decrypt it and complete the submission smoothly.

[0103] Client encryption related data: The encryption and decryption content module in the SDK toolkit of the enterprise user client encrypts the first encryption factor a (if the encryption factor has not been updated) according to the public key K4 of the third service party to obtain the fourth encryption factor ciphertext data B4. The encryption process is similar to the previous encryption factor encryption, and the public key encryption algorithm is used to ensure data security. At the same time, prepare to upload the first ciphertext data (if the work data has not been updated) A1, the first encryption factor ciphertext data B1, and the fourth encryption factor ciphertext data B4 to the workflow data protection system server. The first encryption factor a here is the encryption factor a that has not been updated in Example 3 and has been used in the embodiment. The first ciphertext data A1 is also the ciphertext data obtained by encrypting, for example, work data A using the encryption factor a. The first encryption factor ciphertext data B1 is obtained by encrypting the encryption factor a using the public key K1 of the enterprise user, and the fourth encryption factor ciphertext data B4 is obtained by encrypting the encryption factor a using the public key K4 of the third service party.

[0104] Upload data to the server for storage: The enterprise user client uploads the above data to the workflow data protection system server and stores it in correspondence with the first workflow authorization file X1. The first ciphertext data A1 and the fourth encryption factor ciphertext data correspond to the third service provider public key K4 in the first workflow authorization file, and the first ciphertext data A1 and the first encryption factor ciphertext data B1 correspond to the enterprise user public key K1. After receiving the data, the server stores the data in the encrypted content storage module 30221 in the content encryption and decryption server 3022 according to the corresponding relationship in the authorization file, and establishes the correct data association to facilitate subsequent decryption and data management. For example, in the process of submitting a patent application after it is written, it is ensured that the patent application service provider can use its private key to decrypt and obtain relevant data for submission, and the enterprise user can also use his own private key to decrypt and view the data waiting to be submitted for review when necessary.

[0105] Embodiment nine: In order to more clearly explain the detailed operation details of the workflow data processing system in the third embodiment of the present invention, the following uses a ninth embodiment to illustrate the processing flow after the enterprise user in the third embodiment of the present invention obtains the official electronic message content.

[0106] The following interactive process in Example 9 is described by taking the OA document received from the Patent Office in patent affairs and the reply process as an example.

[0107] Obtaining official electronic communication content: Enterprise users receive official electronic communication through a network interface, such as the examination opinion notice on patent applications sent by the Patent Office. The content of these communications can be in PDF, XML and other formats. Enterprise users use the AI ​​module 3016 tool deployed and maintained on the client side to identify and parse the content of official electronic communications. AI module 3016 is based on a deep learning algorithm and has been trained with a large amount of official document data to accurately extract key information from the communication, such as file type, involved workflow nodes, related requirements, etc. For example, in a patent examination opinion notice, AI module 3016 can identify the type of examination opinion (such as novelty issues, creativity issues, etc.) and the specific content that requires enterprise users to respond.

[0108] Trigger a new workflow initiation request: Based on the official electronic letter content identified by the AI ​​module, the enterprise user client automatically triggers the enterprise user's second workflow initiation request. This process is similar to the workflow initiation request trigger mechanism in Example 1. The enterprise user client sends a request message containing specific identifiers and parameters to the workflow data protection system server through a pre-configured network communication protocol (such as the HTTPS protocol), including key information extracted from the official letter as request parameters. For example, in the patent application process, if the examination opinion involves modifying the patent application documents, the client will trigger the initiation request for modifying the workflow, and send the relevant requirements in the examination opinion as part of the request to the workflow data protection system server.

[0109] Obtaining the public key data in the new workflow authorization file: After the workflow data protection system server receives the second workflow initiation request, it selects the corresponding template from the predefined workflow template library according to the workflow type identifier in the request (such as the patent application modification workflow), and generates the second workflow authorization file X2. The server determines the enterprise users and new service providers involved in the workflow (such as new patent agents or lawyers who may be involved to assist in responding to the review opinion) and obtains their public key data. The enterprise user public key is uploaded and stored on the workflow data protection system server when registering or using the system for the first time, and the service provider public key is obtained based on the service provider's registration information. The server stores the generated second workflow authorization file (including workflow node information, public key data of each party, authorization content description, etc.) in the authorization file server, and returns the service provider public key data and enterprise user public key data of the current working node to the enterprise user client through a secure network connection. After receiving the public key data, the enterprise user client stores it in the local memory or secure storage area for subsequent encryption operations.

[0110] Generate encryption factor: The enterprise user client generates encryption factor using the algorithm in its built-in SDK toolkit. The generation method is similar to that in Example 1, for example, a secure random number generator is used to generate a random binary sequence as a key, and the key length can be 128 bits, 192 bits, or 256 bits. The generation of encryption factor is based on complex algorithms and hardware entropy sources (such as thermal noise, clock jitter, etc.) to ensure that it has sufficient randomness. This encryption factor will be used to encrypt the work data of enterprise users for official communications.

[0111] Encrypt enterprise user work data: Enterprise users prepare work data related to official communications, such as reply document ideas for review opinions, supplementary OA reply technical materials for debate, etc. Work data types may include text, pictures, audio, video, etc. Use the generated encryption factor to encrypt the second work data of the enterprise user to obtain the second ciphertext data. The encryption process is carried out according to the requirements of the work data type and encryption algorithm. For example, for text data, the AES algorithm may be used for block-by-block encryption; for picture or video data, the data may be divided into blocks first, and then the encryption factor is used for encryption operation to finally obtain the encrypted ciphertext data.

[0112] Encrypt the encryption factor (using the enterprise user's public key): The enterprise user client uses the enterprise user's public key to encrypt the encryption factor to obtain the fifth encryption factor ciphertext data. The encryption process involves operations such as modular exponentiation in public key encryption algorithms (such as RSA algorithms). The specific calculation process is (where is the encrypted encryption factor ciphertext data, is the encryption exponent in the public key, and is the modulus in the public key). In this way, the confidentiality of the encryption factor during transmission and storage is ensured, and only the enterprise user can decrypt and obtain the encryption factor using his private key.

[0113] Encrypt the encryption factor (using the service provider's public key): The enterprise user client also uses the service provider's public key to encrypt the encryption factor to obtain the sixth encryption factor ciphertext data. The encryption calculation method is similar to that of encryption using the enterprise user's public key. It is operated according to the public key encryption algorithm, so that the service provider can use its private key to decrypt and obtain the encryption factor, and then decrypt the work data. In this way, both the enterprise user and the service provider can decrypt the encryption factor with their respective private keys, thereby decrypting the work data, realizing the secure sharing and processing of data between the two parties.

[0114] Upload data to the server for storage: The enterprise user client uploads the second ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data to the workflow data protection system server and stores them in correspondence with the second workflow authorization file. Here, the second workflow authorization file is, for example, the workflow authorization file X2. The second ciphertext data and the fifth encryption factor ciphertext data correspond to the enterprise user public key in the second workflow authorization file, and the second ciphertext data and the sixth encryption factor ciphertext data correspond to the service provider public key in the second workflow authorization file. After receiving the data, the workflow data protection system server stores the data in the encrypted content storage module 30221 in the content encryption and decryption server 3022 according to the corresponding relationship in the authorization file X2.

[0115] Embodiment ten: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses an embodiment 10 to illustrate the payment process of the enterprise user in the third embodiment of the present invention.

[0116] The following is the interactive process of payment by the enterprise user in the tenth embodiment.

[0117] Sending service completion information: After completing the task of the current work node, the enterprise user sends the service completion information to the workflow data protection system server through the SDK toolkit in the enterprise browser client. This information contains the unique identifier of the enterprise user (such as the enterprise user ID or user name), the completed work node identifier, and the sending timestamp, so that the server can accurately identify and record the completion status of the node. For example, in the patent application process, when the patent application submission work node is completed, the enterprise user sends the service completion information containing the enterprise user ID, the "patent application submission completed" node identifier, and the current time.

[0118] The server detects the payment node: After the workflow data protection system server receives the service completion information, it detects whether the next workflow node is the enterprise payment workflow node based on the information of the current workflow node in the first workflow authorization file X1. The server searches for the subsequent node information of the current node from the authorization file template library in the authorization file server or the generated workflow authorization file to determine whether it is a payment node. If it is detected to be a payment node, the payment process related operations are started; if it is not a payment node, the processing of other workflow nodes is continued according to the preset process or the next service completion information is waited for.

[0119] Settlement of the amount to be paid: When the next node is determined to be the payment node, the server obtains the amount to be paid corresponding to the current workflow node from the service fee list pre-registered with the service provider. The fee list records in detail the charging standards and calculation basis for each workflow node or service item (such as service duration, service type, contract agreement, etc.). For example, in the patent application process, according to the previously signed service contract, the service fee for the patent application submission node is determined to be a certain amount, and the server calculates the amount to be paid for the node.

[0120] Generate payment link information: The server generates link information that the enterprise can use for payment. The link points to a secure payment page for enterprise users to complete payment operations. The payment link information contains relevant parameters such as the payment amount, payment object (service provider information), and payment purpose (such as patent application service fees). At the same time, to ensure payment security, the payment link is protected by encryption technology to prevent information leakage and tampering. For example, a payment link containing the enterprise user ID, service provider name, payment amount and encrypted verification code is generated, and the link points to the secure payment gateway on the server side. The generation of these payment link information and the completion of the subsequent payment process are preferably completed in the payment server 30234 in Example 3. It can also be completed with the assistance of an external third-party payment system, such as the payment process after secondary development of Alipay payment service and WeChat payment service.

[0121] Encrypted payment link information (using the enterprise user's public key): The server encrypts the link information that can only be used for payment by the enterprise based on the enterprise user's public key to obtain the first encrypted payment ciphertext data. The encryption process uses a public key encryption algorithm (such as the RSA algorithm) to convert the payment link information into ciphertext form by calculating (where is the encrypted encrypted payment ciphertext data, is the encryption exponent in the public key, and is the modulus in the public key), ensuring that only the enterprise user can use their private key to decrypt and obtain the real payment link information, thereby ensuring the security of the payment information during transmission.

[0122] Sending encrypted payment ciphertext data to the enterprise user client: The server sends the first encrypted payment ciphertext data to the enterprise user client through a secure network connection. After receiving the data, the enterprise user client stores it in the local memory or secure storage area, waiting for the enterprise user to perform a decryption operation. For example, in the patent application payment process, the client receives the encrypted payment link ciphertext data and prepares for subsequent decryption processing.

[0123] The enterprise user decrypts the payment link and completes the payment: The enterprise user uses his enterprise user private key to perform the decryption operation on the enterprise client. According to the inverse operation of the public key encryption algorithm (such as the RSA algorithm), calculate (where is the decryption index in the private key) to obtain the link information that the enterprise can use for payment. The enterprise user clicks the decrypted payment link, enters the secure payment page, selects the appropriate payment method (such as Alipay, WeChat Pay, digital RMB and other third-party payment channels), and completes the payment operation according to the prompts on the payment page. After the payment is successful, the server receives the payment confirmation information, updates the workflow status and related records, such as marking the payment node as completed, generating an electronic receipt and providing a link for the enterprise user to download. At the same time, the service provider can be notified that the payment has been completed as needed so that the service provider can continue the subsequent workflow or provide corresponding services.

[0124] The system device embodiments described in the above embodiments are merely illustrative, wherein the units described as separate components may or may not be physically separated. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present embodiment without creative effort.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing workflow data, running on an enterprise user client side, comprising: Triggering the first workflow of the enterprise user to initiate a request; Obtaining the public key data of the first service provider of the current working node in the first workflow node and the public key data of the enterprise user from the first workflow authorization file generated by the workflow data protection system server side according to the first workflow initiation request; generating a first encryption factor; Encrypting first work data of the enterprise user according to the first encryption factor to obtain first ciphertext data; Encrypting the first encryption factor according to the enterprise user's public key to obtain first encryption factor ciphertext data; Encrypting the first encryption factor according to the first service provider's public key to obtain ciphertext data of the second encryption factor; The first ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data are uploaded to the workflow data protection system server and saved correspondingly to the first workflow authorization file; wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the enterprise user public key in the first workflow authorization file, and the first ciphertext data and the second encryption factor ciphertext data correspond to the first service party public key in the first workflow authorization file.

2. The method according to claim 1, characterized in that: Further including: Monitoring the enterprise user's first triggering request for initiating the first workflow; Obtain the enterprise user's public key and enterprise user's private key for asymmetric encryption and decryption; The enterprise user's private key is stored and processed on the client side; The enterprise user public key is uploaded to the workflow data protection system server for storage.

3. The method according to claim 1, characterized in that The first workflow authorization file includes: At least one workflow node generated according to the workflow type corresponding to the first workflow initiation request; The enterprise party, service party and their respective public key data involved in each workflow node; Description of the corresponding authorization content of the enterprise and service provider involved in each workflow node.

4. The method according to claim 3, characterized in that: The description of the authorized content includes: Whether the enterprise and service providers involved in each workflow node can encrypt and decrypt workflow files; and / or The authorization duration of the workflow files in each workflow node; and / or Whether the enterprise and service providers involved in each workflow node can initiate sub-authorization; and / or Payment worker node configuration.

5. The method according to claim 2, characterized in that: Further including: When the first workflow of the enterprise user is triggered to initiate a request, the workflow data protection system server uses the public key of the enterprise user to encrypt the first random string and sends it to the client side of the enterprise user; Decrypting the encrypted first verification code according to the private key of the enterprise user, and transmitting the decrypted verification code back to the workflow data protection system server; If the verification code received by the workflow data protection system server is consistent with the first verification code, the identity of the enterprise user is confirmed.

6. The method according to claim 1, characterized in that Further including: Triggering a decryption and viewing processing request for the first work data of the enterprise user; After the workflow data protection system server determines that the description in the first workflow authorization file corresponding to the enterprise user meets the authorization conditions, the first ciphertext data and the first encryption factor ciphertext data of the first work data in the current workflow node are obtained from the workflow data protection system server; Obtain the enterprise user private key of the enterprise user from the enterprise user client side; Decrypting the first encryption factor ciphertext data according to the enterprise user's private key to obtain the first encryption factor; The first ciphertext data is decrypted according to the first encryption factor to obtain first working data.

7. The method according to claim 1, characterized in that Further including: Obtaining service provider information involved in the current workflow node in the first workflow authorization file in the workflow data protection system server; Initiate an update request for the service provider information involved in the current workflow node; Obtaining description information of a service provider that can provide similar services in the workflow data protection system server; Obtaining a second service provider selected by the enterprise user from service providers that can provide similar services; Update the service provider information of the current workflow node in the first workflow authorization file in the workflow data protection system server to the second service provider information; Encrypting the first encryption factor according to the public key of the second service provider to obtain ciphertext data of the third encryption factor; Uploading the first ciphertext data and the third encryption factor ciphertext data to the workflow data protection system server corresponds to the second service party public key in the first workflow authorization file.

8. The method according to claim 1, characterized in that: Further including: Sending service completion information in the current workflow node to the workflow data protection system server; Checking, at the workflow data protection system server side, whether the ciphertext data and encryption factor ciphertext data in the current workflow node have been uploaded by the enterprise party and / or the service party; The corresponding authorization contents of the enterprise party and the service party involved in the current workflow node in the first workflow authorization file conform to the described authorization status; Obtaining information about a third-party service provider involved in a next workflow node of the current workflow node; Update the current workflow node in the first workflow authorization file in the workflow data protection system server to the next workflow node, and update the service provider information therein to the third service provider information; Send the third-party service provider's public key to the enterprise user's client side; Encrypting the first encryption factor according to the public key of the third service provider to obtain ciphertext data of the fourth encryption factor; Upload the first ciphertext data, the first encryption factor ciphertext data, and the fourth encryption factor ciphertext data to the workflow data protection system server and store them in correspondence with the first workflow authorization file; The first ciphertext data and the fourth encryption factor ciphertext data correspond to the third service provider public key in the first workflow authorization file.

9. The method according to claim 1, characterized in that: Further including: Obtain the first official electronic communication content through the network interface; According to the identified first official electronic message content, trigger the second workflow of the enterprise user to initiate a request; Obtain the public key data of the fourth service provider of the current working node in the second workflow node and the public key data of the enterprise user from the second workflow authorization file generated by the workflow data protection system server side according to the second workflow initiation request; generating a second encryption factor; Encrypting the second working data of the enterprise user according to the second encryption factor to obtain second ciphertext data; Encrypting the second encryption factor according to the enterprise user's public key to obtain ciphertext data of the fifth encryption factor; Encrypting the second encryption factor according to the fourth service provider public key to obtain ciphertext data of the sixth encryption factor; The second ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data are uploaded to the workflow data protection system server and saved in correspondence with the second workflow authorization file; wherein the second ciphertext data and the fifth encryption factor ciphertext data correspond to the enterprise user public key in the second workflow authorization file, and the second ciphertext data and the sixth encryption factor ciphertext data correspond to the fourth service party public key in the second workflow authorization file.

10. The method according to claim 1, characterized in that Further including: Sending service completion information in the current workflow node to the workflow data protection system server; The workflow data protection system server detects that the next workflow node in the current workflow node in the first workflow authorization file is a payment workflow node of the enterprise party; Settle the amount to be paid in the current workflow node; Generate link information for payment by enterprises; Encrypting the link information that can be used for payment by the enterprise according to the enterprise user's public key to obtain the first encrypted payment ciphertext data; Sending the first encrypted payment ciphertext data to the enterprise user client side; The enterprise user uses its enterprise user private key to decrypt the link information and complete the payment.

Images