Workflow data processing method

Abstract

The workflow data processing method comprises the following steps: receiving a to-be-participated first workflow node in a first workflow authorization file; sending participation information of the first service party; obtaining first ciphertext data, first encryption factor ciphertext data, enterprise party public key data and a first service party public key; decrypting the first encryption factor ciphertext data according to the first service party private key to obtain a first encryption factor; the first encryption factor decrypts the first ciphertext data to obtain a to-be-processed work file; processing the to-be-processed work file to obtain first work file data; generating a second encryption factor; the second encryption factor encrypts the first working file data to obtain second ciphertext data; the enterprise public key data encrypts the second encryption factor to obtain second encryption factor ciphertext data; the first service party public key encrypts the second encryption factor to obtain third encryption factor ciphertext data; and uploading the second ciphertext data, the second encryption factor ciphertext data and the third encryption factor ciphertext data, and storing the second ciphertext data, the second encryption factor ciphertext data and the third encryption factor ciphertext data correspondingly with the first workflow authorization file.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for processing workflow data. Background Art

[0002] In today's digital age, the collaboration between enterprises and service agencies is becoming increasingly frequent, involving many professional service areas, such as intellectual property services (including patents, trademarks, copyrights, etc.), legal services, corporate services, etc. In these areas, efficient organization of workflows and data security have become key issues. Existing intellectual property registration application services mainly rely on manpower to implement workflows, and mostly use patent process software for centralized file management to achieve service workflow scheduling. For example, patent agency companies, as central servers, provide information exchange in the company's mailbox network or workflow for enterprise Party A and patent agents. However, this traditional model has many disadvantages. For enterprise Party A, it is difficult to confirm the identity of the service personnel who write the specific materials, and it is impossible to ensure whether the designated contracted patent agent is handling the business. This not only affects the control of service quality, but also may lead to information leakage risks.

[0003] Among some related technologies that have been disclosed, such as the patent named "Patent Writing and Reply Project Management System" (application number CN201910125120.7), although it has realized functions such as patent allocation, project progress monitoring, and file upload to a certain extent, and improved the efficiency of some processes, it has not yet given an effective solution for how to efficiently organize workflows between relevant entities and ensure the information security and privacy of all parties. In particular, in terms of data encryption, authorization management, and flexible changes of service providers, the existing technology cannot meet actual needs. For example, during the execution of the workflow, if the enterprise needs to change the service provider, the existing technology is difficult to achieve convenient updates of the service provider's information, and cannot guarantee the security and continuity of the data during the change of the service provider. At the same time, for data encryption in the workflow, there is a lack of effective management of encryption factors and multi-party sharing mechanisms, resulting in the risk of data being stolen or tampered with during transmission and storage. In addition, in the payment link, the existing technology fails to provide a safe, convenient and workflow-integrated payment solution, and cannot meet the needs of enterprises and service providers in fee settlement.

[0004] Therefore, in order to improve the collaboration efficiency between enterprises and service agencies and ensure the security and privacy of data in workflows, an innovative workflow data processing method is urgently needed, especially a workflow processing mechanism on the service side, to achieve efficient, secure and flexible workflow management to meet the needs of different business scenarios. Summary of the invention

[0005] The embodiment of the present invention provides a method for processing workflow data, which is used to achieve efficient professional generation of workflows for service agencies and ensure the privacy rights and interests of user data in the workflow.

[0006] In a first aspect, an embodiment of the present invention provides a method for processing workflow data, which runs on a user client side of a first service party, and includes: receiving information of a first workflow node to be participated in a first workflow authorization file on a server side of a workflow data protection system; sending confirmation participation information of the first service party to the first workflow node; obtaining first ciphertext data of the work file data to be processed uploaded by an enterprise party in the first workflow node, first encryption factor ciphertext data, and public key data of the enterprise party and a public key of the first service party in the first workflow node, wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the public key of the first service party in the first workflow authorization file; decrypting the first encryption factor ciphertext data according to the first service party private key on the user client side to obtain the first encryption factor; using the first encryption factor to decrypt the first ciphertext data to obtain the work file data to be processed file data; obtain the first work file data after processing according to the work file data to be processed; generate a second encryption factor; encrypt the first work file data according to the second encryption factor to obtain the second ciphertext data; encrypt the second encryption factor according to the enterprise public key data in the first workflow node to obtain the second encryption factor ciphertext data; encrypt the second encryption factor according to the first service party public key to obtain the third encryption factor ciphertext data; upload the second ciphertext data, the second encryption factor ciphertext data, and the third encryption factor ciphertext data to the workflow data protection system server and save them in correspondence with the first workflow authorization file; wherein the second ciphertext data and the second encryption factor ciphertext data correspond to the enterprise user public key in the first workflow node, and the second ciphertext data and the third encryption factor ciphertext data correspond to the first service party public key in the first workflow node.

[0007] Optionally, the first workflow authorization file includes: at least one workflow node generated according to the workflow transaction type; the enterprise party, service party and their respective public key data involved in each workflow node; and a description of the corresponding authorization content of the enterprise party and service party involved in each workflow node.

[0008] Optionally, the description of the authorization content includes: whether the enterprise party and service party involved in each workflow node can encrypt and decrypt the workflow file; and / or the authorization duration of the workflow file in each workflow node; and / or whether the enterprise party and service party involved in each workflow node can initiate re-authorization; and / or the configuration of the payment work node.

[0009] Optionally, an embodiment of the present invention further includes: monitoring the service user's first access to the workflow data protection system server; obtaining the service user's public key and service user's private key that the service user can use for asymmetric encryption and decryption; storing the service user's private key on the client side; uploading the service user's public key to the workflow data protection system server for storage.

[0010] Optionally, an embodiment of the present invention further includes: a service-side user initiates a request to update a service provider; obtains the service provider who provides work services in the same work node; notifies the workflow data protection system server to update the service-side information in the first workflow node in the first workflow authorization file to the newly selected first service provider information; obtains the public key data of the first service provider; uses the public key data of the first service provider to encrypt the first encryption factor on the service-side user client to obtain the ciphertext data of the fourth encryption factor; uploads the first ciphertext data and the ciphertext data of the fourth encryption factor to the workflow data protection system server and stores them in correspondence with the public key data of the first service provider in the first workflow node in the first authorization file.

[0011] Optionally, an embodiment of the present invention further includes: monitoring the working status information of the first service party; sending the working status information to an AI (Artificial Intelligence) module for analysis to obtain workflow node information that needs to be adjusted in the first workflow authorization file; adjusting the authorization allocation content in the workflow node of the first workflow authorization file, and updating the first workflow authorization file; notifying the service party user and the enterprise party user of the change information of the workflow node in the first workflow authorization file.

[0012] Optionally, an embodiment of the present invention further includes: monitoring the working status information of the first service party; sending the working status information to the AI ​​module for analysis to obtain the service resources and / or service tool information required by the service party in the current workflow node; and loading the entry for the service resources and / or service tool information on the user client side of the first service party.

[0013] Optionally, before obtaining the first ciphertext data of the work file data to be processed uploaded by the enterprise in the first workflow node, the first encryption factor ciphertext data, the enterprise public key data and the public key of the first service party in the first workflow node, an embodiment of the present invention further includes: checking whether the first service party user meets the status conditions described in the authorization content in the first workflow authorization file; if the authorization status of the service party user does not meet the conditions, preventing the first ciphertext data of the work file data to be processed uploaded by the enterprise, the first encryption factor ciphertext data, the enterprise public key data and the public key of the first service party in the first workflow node from being sent to the service party user client.

[0014] Optionally, an embodiment of the present invention further includes: monitoring the working status information of the enterprise party in the first workflow node; sending the working status information to the AI ​​module for analysis to obtain feedback information from the enterprise party user; sending the feedback information from the enterprise party user to the user client side of the first service party in the current working node; and adjusting the processing method of the working file data based on the feedback information from the enterprise party user.

[0015] Optionally, an embodiment of the present invention further includes: obtaining the content of the first official electronic message through a network interface; triggering a first workflow initiation request of the first service party based on the identified content of the first official electronic message; obtaining the public key data of the first service party of the current working node in the second workflow node and the public key data of the enterprise user from the second workflow authorization file generated based on the first workflow initiation request on the server side of the workflow data protection system; generating a third encryption factor; encrypting the content of the first official electronic message based on the third encryption factor to obtain third ciphertext data; encrypting the third encryption factor based on the public key of the enterprise user to obtain fifth encryption factor ciphertext data; encrypting the third encryption factor based on the public key of the first service party to obtain sixth encryption factor ciphertext data; uploading the third ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data to the server side of the workflow data protection system and saving them in correspondence with the second workflow authorization file; wherein the third ciphertext data and the fifth encryption factor ciphertext data correspond to the public key of the enterprise user in the second workflow authorization file, and the third ciphertext data and the sixth encryption factor ciphertext data correspond to the public key of the first service party in the second workflow authorization file.

[0016] By adopting the present invention, the service-side user can receive the workflow node in which he can participate on his client, and can decrypt the work file authorized by the enterprise, and encrypt and upload the work file to the current work node after completing the work file, waiting for the decryption download review of the enterprise. In the present invention, the service-side cooperates with the workflow authorization file on the server side of the workflow data protection system, and gives different decryption and use permissions to different enterprises and service-side through the authorization content description of the authorization file. And by using the service-side public key and the enterprise user public key of the current work node in the authorization file, the encryption of the data to be processed is realized, and it is uploaded to the workflow data protection system server side and saved in correspondence with the workflow authorization file, so that subsequent enterprise users and service-side users can use their private keys for their own decryption and interaction. It can be seen that in the present invention, the service-side user uses the workflow authorization file to realize the generation of efficient and professional workflows for enterprise needs, and uses public and private key pairs to ensure the privacy protection of user work data in the workflow for enterprise users. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a method for processing workflow data provided in Embodiment 1 of the present invention; Figure 2 A schematic diagram of the composition of the authorization file provided in the second embodiment of the present invention; Figure 3 A schematic diagram of a workflow data processing system provided in Embodiment 3 of the present invention; Figure 4 A schematic diagram of a workflow process for a service provider user to update a service provider's service provider in Embodiment 3 of the present invention; Figure 5 A schematic diagram of a workflow process for processing the working status of a monitoring service provider in Embodiment 3 of the present invention; Figure 6 This is a flow chart of initiating a new workflow after official document recognition in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.

[0021] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0022] In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0023] In an embodiment of the present invention, by separating the work data in the workflow from the authorization file, and encrypting and decrypting the work data by the enterprise user or the service user himself, the authorization content of the authorization file is adjusted according to the experience process and legal process of the specific workflow, and the comprehensive analysis of the processing situation of the enterprise user and the service user by the AI ​​model to adjust the work node processor, work node processing rhythm, work node processing content, etc. in the workflow, thereby giving the enterprise user greater management and flexible adjustment power to improve the efficiency and experience of the service work. In an embodiment of the present invention, the service user uses the workflow authorization file to achieve efficient response to the needs of the enterprise and professional service workflow generation, and uses a public-private key pair to ensure the privacy protection of the service user's work data in the workflow for the service user.

[0024] In addition, the workflow in this embodiment is not limited to the workflow of patent agency services, the workflow of trademark registration services, the litigation workflow of legal lawyers, etc. given in the following preferred embodiments. As long as it is a specific service project between the enterprise and the service provider, the technical solution that initiates a specific workflow by performing the service work therein belongs to the scope of the inventive concept of the present invention.

[0025] Embodiment 1: Figure 1 A flowchart of a method for processing workflow data provided in the first embodiment of the present invention. In the first embodiment, the method for processing workflow data is run on the client side of the service provider user. The method in the first embodiment of the present invention includes the following steps: Step 100: receiving information of a first workflow node to be participated in a first workflow authorization file on a server side of a workflow data protection system; In this step, the service user needs to receive the business work assignment from the enterprise in daily business work. The service user opens its client application, which establishes a secure communication connection with the workflow data protection system server. The server determines the first workflow node that is currently available for the service party to participate in according to the progress and configuration of the workflow, and sends the relevant node information (including node name, node task description, node order in the workflow and estimated processing time, etc.) to the service client. The service client receives and obtains the above-mentioned first workflow node information. For example, in the patent agency service workflow, the first workflow node may be "review of the first draft of the patent application", and the node information will detail the review standards, key focus content, and the deadline for submitting the review results. Preferably, these first workflow node information are encrypted with the service party's public key. After the service client receives and obtains the above-mentioned first workflow node information, the service party's private key can be used to decrypt the workflow node information to view the specific node information content. Since the first workflow node information does not contain encrypted data of the work file content, it can also be transmitted without encryption.

[0026] Preferably, in the first embodiment, on the client side of the service-side user, when it is detected that the service-side user accesses the workflow data protection system server for the first time, the service-side user client side obtains the service-side user public key and service-side user private key that can be used for asymmetric encryption and decryption by the service-side user; stores the service-side user private key on the client side; and uploads the service-side user public key to the workflow data protection system server for storage. Preferably, this monitoring can be implemented in the SDK on the client side of the enterprise user, for example, based on the ID record of the user, it can be determined whether it is the first time to access the workflow data protection system server. In this embodiment, the service user can obtain the user's public key and user's private key for asymmetric encryption and decryption processing by himself, or obtain the enterprise user's public and private key pair from a third-party public and private key pair provider, for example, a digital certificate authority CA (Certificate Authority) that can provide public and private key pairs for asymmetric encryption algorithms (such as RSA algorithms), and the public and private key pairs are provided by the network service interface of the CA of an official or non-profit organization; it is also preferable to generate a public and private key pair for the user in the asymmetric encryption algorithm such as the SDK software package of the present invention (the public and private key pairs in the SDK can also be generated and provided by a credible third party), so that the enterprise user can quickly obtain the public and private key pair. Preferably, the private key in this embodiment can be a browser cache or a client local cache. The private key in this embodiment is stored locally on the client side. In this embodiment, when the user needs to use the private key, the user needs to actively upload the private key to the SDK on the client side for decryption calculation. Since the private key in the public-private key pair is completely securely stored by the user, only the public key is uploaded to the workflow data protection system server. As a result, the workflow data protection system server only needs to perform public key hosting and encrypted data hosting, reducing the workload of client encryption processing and the amount of encrypted data transmitted between the client and the workflow data protection system server, which not only ensures the security of the service user's workflow file data, but also improves the transmission efficiency of the solution of the present invention.

[0027] Step 101: Send the first service provider confirmation participation information for the first workflow node After the service user views the received first workflow node information on the client, he decides whether to participate in the node work. If he decides to participate, the user clicks the confirmation button on the client operation interface, and the client generates confirmation participation information, which includes the service party identification, node name, participation time, etc. Preferably, the client encrypts the confirmation participation information using the server-side public key and sends it to the workflow data protection system server; after receiving the encrypted information, the server uses the private key to decrypt it, records the service party's participation intention, and returns a confirmation receipt notification to the service party client.

[0028] Step 102: Obtain the first ciphertext data of the work file data to be processed uploaded by the enterprise in the first workflow node, the first encryption factor ciphertext data, and the enterprise public key data and the first service party public key in the first workflow node, wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the first service party public key in the first workflow authorization file. The service client sends a request to obtain the work file data to the workflow data protection system server, and the request contains information such as the service party identification and the workflow node identification. After receiving the request, the server checks whether the service party has the authority to obtain the work file data according to the authority configuration in the authorization file. If the authority check passes, the server extracts the first ciphertext data, the first encryption factor ciphertext data, and the corresponding enterprise public key data and the first service party public key from the encrypted content storage module. The server uses the service party's public key to re-encrypt these data (to ensure the security of the data during transmission. Of course, it is better not to re-encrypt here in order to speed up the request efficiency.) and then sends it to the service client. After receiving the encrypted data, the service client uses its private key to decrypt it and obtains the first ciphertext data, the first encryption factor ciphertext data, the enterprise public key data and the first service party public key. For example, after the enterprise uploads the technical information related to the patent application as the work file data to be processed, the service party needs to obtain these data for processing at the review node.

[0029] Step 103: Decrypt the first encryption factor ciphertext data according to the first service provider's private key on the user client side to obtain the first encryption factor The encryption and decryption module of the service party client calls the first service party private key stored locally to decrypt the obtained first encryption factor ciphertext data. The decryption process is based on a specific decryption algorithm (such as the inverse operation of the RSA algorithm) to restore the ciphertext data to the original first encryption factor. For example, if the first encryption factor ciphertext data is encrypted using the RSA algorithm, the decryption exponent in the service party private key will be used to restore the encryption factor. This step ensures that only the service party with the correct private key can obtain the encryption factor, ensuring the security and confidentiality of the data.

[0030] The encryption factor in the steps of this embodiment can be a randomly generated key for symmetric encryption. Other encryption keys using symmetric encryption algorithms can be used as encryption factors in the first embodiment of the present invention. For example, the 128-bit encryption key in the national secret SM4 algorithm can all be covered in the scope of the present invention. Preferably, the present invention can use the AES (Advanced Encryption Standard) algorithm to generate a string of random binary sequences as keys through a secure random number generator, and the key length is 128 bits, 192 bits or 256 bits; the secure random number generator in this embodiment will ensure that the generated key has sufficient randomness based on complex algorithms and hardware entropy sources (such as thermal noise, clock jitter, etc.). Preferably, the first encryption factor is only used in the encrypted data of the current workflow. When a new workflow is initiated, the second encryption factor can be regenerated and applied to subsequent encryption processing to enhance the security level of encryption of the working files of enterprise users or service providers during the workflow process.

[0031] Step 104: Decrypt the first ciphertext data using the first encryption factor to obtain the work file data to be processed The service party client uses the first encryption factor obtained by decryption in step 103 to decrypt the first ciphertext data. According to the pre-set encryption and decryption rules (such as the combination of the AES algorithm and the encryption factor), the ciphertext data is restored to the original work file data to be processed. For example, if the first ciphertext data is encrypted using the AES algorithm combined with the first encryption factor, the same encryption factor and the decryption mode of the AES algorithm are used at this time to convert the ciphertext data into the original file uploaded by the enterprise, such as the patent application briefing document, related technical drawings, etc., so that the service party can perform subsequent processing.

[0032] Step 105: Process the work file data to be processed to obtain the first work file data The service user processes the work file data to be processed according to the task requirements of the workflow node. For example, at the node of reviewing the first draft of the patent application, the service professional carefully reviews the content of the file to check whether there are technical defects, format errors, conflicts with existing technologies, and other issues. Based on the review results, the service provider may modify, annotate or supplement relevant information to the file to generate the first work file data. The processing process may involve the use of professional document editing tools, patent search databases, and communication and collaboration with the enterprise or other relevant parties to ensure that the processed work file data meets the quality requirements and business standards of the workflow. Preferably, these work files are Web format data based on cloud services, which is convenient for the service provider to perform online editing and processing, and also convenient for the cloud service to realize online work progress or status preservation and monitoring, and then achieve better service evaluation of the service provider based on the monitoring data.

[0033] Step 106: Generate a second encryption factor The encryption module of the service client uses a secure random number generation algorithm (such as a random number generator based on a hardware entropy source and a complex algorithm) to generate a second encryption factor. The length and strength of the second encryption factor are determined according to the security policy of the system and the sensitivity of the workflow data. For example, it can be a 128-bit, 192-bit or 256-bit random binary sequence. The generated second encryption factor will be used to encrypt the processed first work file data to ensure the security of the data after uploading to the server and prevent the data from being obtained or tampered with by unauthorized parties.

[0034] Step 107: Encrypt the first working file data according to the second encryption factor to obtain the second ciphertext data The service client uses the second encryption factor generated in step 106 and adopts a suitable encryption algorithm (such as the AES algorithm) to encrypt the first working file data. The first working file data is divided into data blocks of fixed length (such as 128 bits), and a specific operation (such as an XOR operation or an operation specified by other encryption algorithms) is performed on each data block and the second encryption factor to generate encrypted ciphertext data blocks, which are finally combined into complete second ciphertext data. In this way, even if the data is intercepted during transmission or storage, the original data cannot be restored without the correct encryption factor, thereby ensuring the confidentiality of the data.

[0035] Step 108: Encrypt the second encryption factor according to the enterprise public key data in the first workflow node to obtain the second encryption factor ciphertext data The service client obtains the enterprise public key data in the first workflow node and uses the public key to encrypt the second encryption factor. The encryption process follows the rules of the public key encryption algorithm (such as the RSA algorithm) to convert the second encryption factor into the ciphertext form corresponding to the enterprise public key, that is, the second encryption factor ciphertext data. In this way, the enterprise can use its private key to decrypt and obtain the second encryption factor in the subsequent process, and then decrypt the second ciphertext data, so as to realize the secure sharing and interaction of data between the service party and the enterprise.

[0036] Step 109: Encrypt the second encryption factor according to the first service provider's public key to obtain the third encryption factor ciphertext data The service client uses its own first service public key to encrypt the second encryption factor at the same time to generate the third encryption factor ciphertext data. The purpose of this step is to retain the service party's encrypted record of the data in the workflow so that it can be audited or verified when necessary. For example, during data integrity checks or dispute resolution, the correctness and reliability of the data processing process can be ensured by comparing the consistency of the ciphertext data of different encryption factors. Preferably, the first service public key encrypts the third encryption factor ciphertext data so that the user can view the modified version uploaded by himself at any time, thereby proving his workload and work records.

[0037] Step 110: Upload the second ciphertext data, the second encryption factor ciphertext data, and the third encryption factor ciphertext data to the workflow data protection system server and store them in correspondence with the first workflow authorization file; wherein the second ciphertext data and the second encryption factor ciphertext data correspond to the enterprise user public key in the first workflow node, and the second ciphertext data and the third encryption factor ciphertext data correspond to the first service party public key in the first workflow node The service client combines the second ciphertext data, the second encryption factor ciphertext data, and the third encryption factor ciphertext data into an upload data packet, and adds necessary identification information (preferably, such as service party identification, workflow node identification, upload timestamp, etc.). Then, after encrypting the data packet using the server-side public key, it is uploaded to the workflow data protection system server through a secure network connection. Preferably, the server-side public key may not be used to encrypt these uploaded data, because it is encrypted data itself, but it will be safer to encrypt it again. After receiving the encrypted data packet, the server-side uses the private key to decrypt it, and associates the data with the first workflow authorization file according to the identification information. During the saving process, a corresponding relationship between the data and the enterprise user public key and the first service party public key is established to ensure that in the subsequent workflow, the enterprise and service party can accurately obtain and process the corresponding data according to the authorization using their respective private keys, so as to realize the orderly management and secure sharing of workflow data. For example, in the patent application workflow, the server-side saves the data in a specific database table, and realizes the corresponding relationship between the data and the authorization file and the public key through field association, which facilitates the query and call of the data.

[0038] Embodiment 2: In order to more clearly reveal the specific composition of the authorization file generated by the workflow data protection system server in the present invention, a composition diagram of the authorization file is provided in Embodiment 2 of the present invention. Figure 2 A schematic diagram of the composition of the authorization file provided in Embodiment 2 of the present invention.

[0039] In an embodiment of the present invention, the first workflow authorization file preferably includes: at least one workflow node generated corresponding to the workflow transaction type; the enterprise party, service party and their respective public key data involved in each workflow node; and a description of the corresponding authorization content of the enterprise party and service party involved in each workflow node.

[0040] Preferably, an embodiment of the authorization file generated by the workflow data protection system server side in response to the workflow of writing a patent application is described in detail, such as Figure 2The patent application workflow authorization file 200 is shown. The patent application workflow authorization file 200 includes multiple work nodes: such as work node 1 patent briefing writing and entrustment 201, work node 2 patent application draft writing 202, work node 3 patent application draft review 203, work node 4 patent application confirmation and instruction submission 204, work node 5 patent submission 205, and work node 6 patent fee payment 206. The patent application workflow includes the above-mentioned work nodes, which are established based on a complete work cooperation process. After learning by the AI ​​model, these work nodes can be automatically generated according to the request. The patent application workflow authorization file 200 is the core control file of the entire workflow, which is generated by the workflow data protection system server according to the workflow transaction type (for example: patent application workflow). It contains multiple key components, among which the work node is the basic unit for building the workflow. For example, work node 1 patent briefing writing and entrustment 201, this node clarifies the task flow of the enterprise (such as Company A) entrusting the writing of patent-related technical briefings to a specific service provider (such as Company B) at the beginning of the patent application process. Work Node 2: Drafting of the Patent Application 202 indicates that after receiving the briefing, the service provider will proceed to the drafting stage of the patent application according to the requirements of the enterprise. Each work node specifies in detail the enterprise and service provider involved, as well as their respective public key data. Preferably, the information of the enterprise and service provider involved includes: enterprise name (such as Company A), enterprise registration number, enterprise type, legal representative, etc., and the service provider information includes the service provider name (such as Company B), service qualifications, service scope, contact information, etc. This information helps each party to accurately identify the other party in the workflow and ensure the accuracy and legality of the workflow. For example, in the patent application process, the enterprise party A company can evaluate whether the service provider B company has the professional ability to undertake the relevant work through the qualification information of the service provider B company. The service provider B company can also better understand the patent application needs of the enterprise party A company based on its type and business scope, and provide more accurate services. These public key data play a key role in the subsequent data encryption, decryption and interaction process. For example, the public key of company A is used by the service party to encrypt the uploaded data, ensuring that only company A can use its private key to decrypt and view it; the public key of company B is used by the enterprise party to encrypt specific instructions or data, ensuring that only company B can decrypt and perform corresponding operations. At the same time, the work node also contains relevant personnel information such as the enterprise party's agent A1 user and the service party B company's service person B1 user, so as to clarify the responsible party and the specific executor in the work process. The enterprise user here can be a user with the enterprise as the main body, or a specific A1 user of the enterprise's legal agent, both of which can be understood as enterprise users and are solutions within the scope of the present invention.This is the key basis for determining which public key to use for encryption and which private key to use for decryption in subsequent data encryption and decryption operations. For example, in the work node 201 of writing and entrusting the patent briefing, the public key data of the enterprise party A company and the service party B company are recorded in the authorization file. When processing the data of this node, these public keys will be used to encrypt and process the workflow file accordingly.

[0041] At the same time, the patent application workflow authorization file 200 also contains a description of the corresponding authorization content of the enterprise party and the service party involved in each workflow node. This includes but is not limited to the following aspects: Enterprise party and service party information: clarify the basic information of each party for easy identification and management. Whether the workflow file can be encrypted and decrypted: specifies the operation rights of each party to the file in the workflow. For example, some nodes may only allow the enterprise party to encrypt and the service party to decrypt and view, but not allow the service party to encrypt, etc. The authorization duration of the workflow file: determines the allowed time for the effective authorization encryption and decryption of data in a specific node or the entire workflow. If this duration is exceeded, re-authorization or other processing may be required. Whether re-authorization can be initiated: If allowed, the service party or the enterprise party can transfer part of its authority to other parties under certain conditions, which increases the flexibility of workflow processing. Configuration of payment work nodes: For work nodes involving payment, detailed descriptions of payment-related rules, amount calculation methods, payment methods and other information are provided. For example, in the patent fee payment 206 of working node 6, the payment channel, the basis for fee calculation (not shown, the amount in the pre-signed service contract document) and the relationship with other working nodes (not shown, such as whether payment can only be made after a certain predecessor node is completed, etc.) will be clearly stipulated.

[0042] Here are some good examples of descriptions of authorization content in authorization files: Whether the enterprise and service provider involved in each workflow node can encrypt and decrypt workflow files: The authorization content specifies in detail the operating rights of each party to the files at different workflow nodes. At the patent briefing writing and entrustment node 201, the enterprise A company usually has the authority to encrypt and upload the briefing file to protect the confidentiality of the technical information; the service provider B company is only authorized to decrypt and view the file for subsequent writing work, but does not have the authority to encrypt the file. At the patent application draft review node 203, the reviewer (which may be the enterprise or other designated third-party service provider) has the authority to decrypt and view the draft, and can make encrypted annotations or propose amendments based on the review results. The service provider B company needs to decrypt and view the review opinions and make modifications as required before re-encrypting and uploading. This detailed division of permissions ensures the security and controllability of data in the workflow and prevents data leakage or tampering caused by unauthorized operations.

[0043] Authorization duration of workflow files in each workflow node: The files of each workflow node have clear authorization duration limits. For example, in the node 202 of the draft of the patent application, it is stipulated that the service provider Company B shall complete the draft writing and upload it within 10 working days from the date of obtaining the briefing letter from the enterprise party Company A. During this period, the service provider Company B has the operation rights to the file. After this period, the file will automatically enter a locked state or require re-application for authorization to continue operation. This helps to ensure the timeliness of the workflow and avoid the entire patent application process being affected by delays in a certain link. At the same time, it also encourages all parties to handle work tasks in a timely manner and improve work efficiency.

[0044] Whether the enterprise party and service party involved in each workflow node can initiate sub-authorization: The authorization content also involves relevant provisions on sub-authorization. In some cases, if the service party B company is unable to continue to complete a certain work task due to special reasons, and sub-authorization is allowed in the authorization document, B company can, under certain conditions (such as notifying the enterprise party A company in advance and obtaining consent, providing detailed information and qualification certificates of the sub-authorized object, etc.), sub-authorize part or all of its rights at the work node to other service parties with corresponding capabilities or to other service personnel of the service party B company. For example, if the main writer of B company suddenly falls ill and cannot work, B company can, after obtaining the permission of A company, transfer the task of writing the first draft of the patent application to another qualified service party C company or to another main writer of B company. These main writers can have their own public and private keys, and their public keys are stored on the server side, which is convenient for sub-authorization operations. This flexibility helps to deal with emergencies that may occur in the workflow and ensure the continuity of work, but it also requires a strict control mechanism to protect the rights and interests of the enterprise party and the quality of work.

[0045] Configuration of payment work nodes: For work nodes involving payment (such as patent fee payment node 206), the authorization document describes in detail the payment-related rules, amount calculation method, payment method and other information. The payment rules clarify the triggering conditions for payment. For example, after the patent application is successfully submitted, the enterprise A company needs to complete the payment within 5 working days; the amount calculation method is determined according to the pre-signed service contract, which may be calculated based on factors such as the complexity, workload, and time cost of the service project; the payment method can include bank transfer, electronic payment platform (such as Alipay, WeChat payment) and other options. At the same time, it also stipulates the relationship between payment and other work nodes. For example, before the payment is completed, some subsequent work (such as patent certificate collection) may not be carried out, ensuring the close integration of the payment link with the entire workflow and protecting the economic interests of all parties.

[0046] The description of these authorized contents is only a preferred example, and any desired combination thereof may be made, all within the protection scope of the present invention.

[0047] Figure 2 The work node 2 with a color block in the middle is the current work node, which is the node where the first draft of the patent application is being written. It is processed by the service provider B company, whose service person is B1, and the service provider's public key is used. This public key is preferably the public key of B company, or it can be the public key of service person B1, both of which can be used as the service provider's public key in the present invention. The authorization period is 15 working days, starting from the time the service provider receives the work node. If it exceeds 15 working days, the authorization content will expire and the encrypted file will no longer be sent to the service provider client for editing and processing by the service provider.

[0048] In the present invention, in addition to the patent application workflow authorization file 200, there may also be authorization files for other workflow affairs between the enterprise and the service provider involved in other patent agency services. The principle is similar to that of the second embodiment, and will not be repeated here. In addition, the workflows of other legal affairs are also similar to the authorization files in this embodiment and are also covered in the scope of the present invention.

[0049] Embodiment three: In order to more clearly disclose the workflow data processing system according to the present invention, Figure 3 A schematic diagram of the framework of a workflow data processing system provided by Embodiment 3 of the present invention is shown in FIG.

[0050] The workflow data processing system in the third embodiment includes: an enterprise browser client 301 , a workflow data protection system server 302 , and a service browser client 303 .

[0051] The enterprise browser client 301 includes an SDK toolkit, which contains: Content display module 3011: displays workflow-related information to enterprise users, such as the progress of work nodes, authorization status, data content that needs to be processed, etc. It is presented to users in the form of an intuitive interface, which is convenient for users to understand the overall situation of the workflow and perform operations, and displays the decrypted workflow files, and is convenient for enterprise users to review and process. The trigger for initiating a request for the workflow can be set in this module. After the confirmation of the content authorization module 3013, this module can use the encryption and decryption content module 3012 to display the decrypted content. If the content authorization conditions are not met, for example, the authorization time has passed, the decryption operation cannot be performed.

[0052] The encryption and decryption content module 3012 is responsible for obtaining the public key data of the service provider of the current working node and the public key data of the enterprise user from the workflow data protection system server 302; generating an encryption factor, and encrypting the working data of the enterprise user according to the encryption factor to obtain ciphertext data, and encrypting the encryption factor according to the enterprise user public key to obtain the first encryption factor ciphertext data; and encrypting the encryption factor according to the service provider public key to obtain the second encryption factor ciphertext data, uploading the ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data to the workflow data protection system server 302 and saving them in correspondence with the authorization file of the workflow where the current working node is located, so that the ciphertext data, the first encryption factor ciphertext data, and the second encryption factor ciphertext data at the current node can be found according to the authorization file, so that these ciphertext data can be obtained during the later decryption. For example: the enterprise party at the current node in the authorization file can record the storage path information of the ciphertext data and the first encryption factor ciphertext data uploaded by it, and save them in correspondence with the enterprise party public key of the authorization file. For example, the storage path information of the uploaded ciphertext data and the second encryption factor ciphertext data can be recorded at the service side at the current node in the authorization file, and saved corresponding to the service side public key of the authorization file. These saves are processed in the workflow data protection system server 302. At the same time, it is also used to obtain the ciphertext data and encryption factor ciphertext data corresponding to the enterprise side public key at the current working node from the workflow data protection system server 302, and use the enterprise side's private key to perform decryption operations on the enterprise side client.

[0053] Content authorization module 3013: manages enterprise users' authorization-related matters of file data in the workflow. It interacts with the workflow data protection system server to perform operations such as applying for authorization, checking the authorization scope, and updating the confirmation management of the authorization content, and coordinates with the presentation content module 3011, the encryption and decryption content module 3012, and the authorization content update module 3014.

[0054] Authorization content update module 3014: When an enterprise user needs to update the authorization content of a workflow node (such as changing the service provider, adjusting the authorization duration, changing the payment channel, etc.), this module is responsible for initiating a request and coordinating with the workflow data protection system server to complete the update operation.

[0055] Monitoring tool 3015: monitors the status of workflow in real time, including the upload and download progress of enterprise users' work file data, server connection status, execution status of work nodes, editing time in work files, etc., and feeds this information back to AI module 3016 or workflow data protection system server, and after analysis, it is displayed to enterprise users or service users for viewing, so that users can promptly understand whether the workflow is running normally and the user's processing status, thereby increasing transparency.

[0056] AI module 3016: Use artificial intelligence technology to analyze the data collected by monitoring tool 3015 in a large model, such as intelligently analyzing the work data of enterprise users, predicting possible problems in the workflow or providing optimization suggestions, and assisting enterprise users to better manage workflows. This module communicates with the workflow data protection system server 302 to update and manage the parameters of its AI model, synchronize with the AI ​​server on the server side, and then realize edge AI computing on the client to meet the fast AI computing of enterprise users on the client, and communicate and synchronize the calculation results with other modules and the workflow data protection system server.

[0057] The workflow data protection system server 302 includes: a user server 3021, a content encryption and decryption server 3022, a workflow authorization file server 3023, and an AI server 3024.

[0058] The user server 3021 includes: a user identity authentication module 30211, a user status supervision module 30212, a user public key escrow module 30213, an encrypted content management module 30214, and an authorization file management module 30215. The user identity authentication module 30211 verifies the binding identity of the enterprise user and the service user, as well as their corresponding handlers or service personnel, to determine that they are the corresponding enterprise users or service users; and collects the user status monitoring data from the monitoring tool 3015 and the monitoring tool 3034 and the analysis results of the AI ​​module 3015 and the AI ​​module 3035 through the user status supervision module 30212, performs data management, and provides data for the subsequent AI server 3023; the user public key escrow module 30213 specifically manages and saves the public keys of serious users. Because the public keys are used in many situations, the user public key escrow module 30213 is specially set to manage and save the public keys uploaded by the user client side. The encrypted content management module 30214 is configured to manage the encrypted content uploaded by the user side, and to provide storage address information for the encrypted content to be used in the subsequent encrypted content storage module 30221, the authorization file template library 30231, etc., so as to facilitate access; the workflow authorization file management module 30215 is used to communicate and manage the workflow and authorization files in the subsequent workflow authorization file service 3023, so as to facilitate users to access the content therein, and receive user requests for updates, etc., so as to perform management operations such as update processing in the workflow authorization file service 3023; The content encryption and decryption server 3022 includes: an encrypted content storage module 30221, which stores the ciphertext data, encryption factor ciphertext data, etc. uploaded by the enterprise user or the service user. These storages are stored in correspondence based on the user public key. For example, the ciphertext data and the encryption factor ciphertext data are stored in correspondence with the enterprise user public key. For example, the ciphertext data and the encryption factor ciphertext data are stored in correspondence with the service public key, and are stored in correspondence with the workflow authorization file in the workflow authorization file service 3023. The above corresponding storage can be maintained through a table in a database to achieve this corresponding relationship, and it is also convenient to query and call access. In addition, the content encryption and decryption server 3022 also includes an encrypted content authorization module 30222, which is convenient for the enterprise user to authorize the encrypted content to different service users. This authorization requires the enterprise user to apply for the public key of the service user to be authorized, and use the public key to encrypt the encryption factor, so that the authorized user can use its private key to decrypt and obtain the encryption factor, so that the encrypted factor can be used to decrypt the work file, thereby realizing the authorization or transfer authorization processing.

[0059] The workflow authorization file server 3023 includes: an authorization file template library 30231, an authorization description content generation module 30232, a workflow generation module 30233, and a payment server 30234. The authorization file template library 30231 stores the generated authorization files for common workflows, such as the authorization file module for writing patent applications mentioned in the first embodiment. The module also receives the content generated by the authorization description content generation module 30232 and the workflow generation module 30233, which can be stored for use after review and confirmation. For example, the authorization description content generation module 30232 and the workflow generation module 30233 generate a corresponding authorization file required to complete a user-specific workflow. Preferably, the authorization description content generation module 30232 and the workflow generation module 30233 can also receive data from the AI ​​server 3024, and generate corresponding workflow nodes or authorization description content according to the optimized workflow node design scheme of the AI ​​server. For example, the processing time of the work file of the enterprise user analyzed by the enterprise user data collection and analysis module 30241 needs to be dynamically adjusted, so that the authorization description content generation module 30232 can adjust the parameter content in its authorization file; preferably, the authorization description content generation module 30232 and the workflow generation module 30233 can also receive the intelligent workflow allocation data pushed by the AI ​​server 3024, which includes the workflow generated according to the workflow type, and the information of the matching service party that can efficiently complete the task in the workflow. These AI-generated matching service party information can be determined by the enterprise user after the final selection to form the final workflow authorization file. Preferably, if there is a payment node in the node of the workflow, and the payment needs to be completed before proceeding to the next node, the payment will be completed in the payment server 30234.

[0060] Preferably, the payment server 30234 is configured to ensure that the enterprise and the service provider use secure multi-party computing (MPC) to jointly calculate certain key indicators or perform data processing in the workflow without disclosing the privacy of their respective user data. For example, in the process of calculating patent fees, the enterprise and the service provider can jointly calculate the accurate fee amount based on pre-set rules and the data they have (such as service duration, service type, contract terms, etc.) without disclosing sensitive data to other parties. Through the MPC protocol, the enterprise browser client can conduct secure data interaction and computational collaboration with other participants. During the calculation process, the data always exists in encrypted form, and only the final calculation result is decrypted and displayed under the authorization conditions, which effectively protects the data privacy and business secrets of all parties and ensures the smooth completion of payment.

[0061] Preferably, the workflow generation module 30233 further includes a workflow data blockchain storage module (not shown), which is configured to store the generated workflow key data (such as workflow initiation requests, data encryption records, service provider selection and change records, payment records, etc.) on the blockchain. The distributed ledger characteristics of the blockchain ensure that the data cannot be tampered with and is traceable, and provide reliable records for the entire life cycle of the workflow. The data of each workflow node is packaged into a block, containing the hash value, timestamp, data content and other information of the previous block, forming a chain structure. In this way, any tampering with the workflow data will be detected by the nodes in the blockchain network, ensuring the authenticity and integrity of the data. At the same time, enterprise users, service providers, and regulatory agencies can query and verify the historical records of the workflow at any time, enhancing the transparency and trust of the workflow.

[0062] Preferably, the workflow generation module 30233 further includes a smart contract driven workflow automation module (not shown), which is configured as a blockchain-based smart contract for automatically executing some rules and processes in the workflow. For example, in the process of selecting a service provider, the enterprise user can set selection criteria and conditions (such as service provider qualifications, historical evaluation, quotation range, etc.) through the smart contract, and the smart contract automatically screens qualified service providers and sorts and recommends them according to preset rules. Once the enterprise user confirms the selection, the smart contract automatically executes operations such as service provider signing and workflow authorization, reducing human intervention and improving workflow efficiency. Further, the workflow generation module 30233 is configured to use smart contracts to realize the automatic audit function of the workflow. During the execution of the workflow, the smart contract monitors in real time whether the operations of each node comply with the pre-set rules and processes (such as data encryption requirements, authorization scope restrictions, payment conditions, etc.). If a violation is found, the smart contract automatically triggers the early warning mechanism and records a detailed audit log to provide a basis for subsequent responsibility tracing and problem handling. At the same time, the smart contract can also regularly generate workflow audit reports for review by enterprise management and regulatory agencies to ensure the compliance and standardization of the workflow. Preferably, the workflow generation module 30233 is configured to realize automatic settlement of the service party's fees by using smart contracts. For example, the smart contract code is embedded in the workflow authorization file, and the contract automatically triggers the fee settlement process according to pre-set rules (such as the completion of the workflow node, the achievement of the service quality index, etc.). The service party's browser client interacts with the smart contract, obtains the fee settlement related information, and completes the payment or collection operation according to the contract execution result. The smart contract can be connected with an external payment system (such as a bank payment interface, a third-party payment platform, etc.) to realize the automatic transfer of funds. At the same time, the smart contract can also dynamically adjust the fee settlement amount according to the performance of the service party (such as whether the task is completed on time, whether the work quality meets the standard, etc.), and encourage the service party to provide high-quality services. The smart contract platform (not shown) is deployed in the workflow authorization file server 3023. During the generation process of the workflow authorization file, the authorization description content generation module writes the fee settlement rules into smart contract code and embeds them into the authorization file. For example, in the patent application workflow, it is stipulated that when the service provider completes the draft of the patent application and passes the review of the enterprise, the smart contract automatically calculates the service provider's due fees according to the pre-agreed fee calculation method (such as calculation according to the number of words, difficulty coefficient, etc.). The content authorization module of the service provider's browser client interacts with the smart contract platform to obtain the status information of the workflow node in real time. When the workflow node is completed and the fee settlement conditions are met, the smart contract platform automatically triggers the fee settlement process. The smart contract calculates the actual amount of fees to be paid based on the preset rules and the data collected during the execution of the workflow (such as the time it takes for the service provider to complete the task, the enterprise's evaluation, etc.).The smart contract initiates a payment request to the service provider through the interface with the external payment system. According to the contract instructions, the payment system deducts the corresponding fees from the enterprise account and transfers them to the service provider account. At the same time, the payment system feeds back the payment results to the smart contract platform and the service provider's browser client, and the service provider's browser client updates the fee settlement status and displays it to the service provider's users. If the service provider performs well in the workflow (such as completing the task ahead of schedule and with excellent quality), the smart contract can increase the service provider's remuneration according to the preset reward mechanism; conversely, if the service provider breaches the contract or has quality problems, the smart contract can deduct the corresponding liquidated damages.

[0063] Among them, the AI ​​server 3024 includes: an enterprise user data collection and analysis module 30241, a service agency user data collection and analysis module 30242, and an intelligent workflow allocation module 30243. The AI ​​server 3024 deploys and runs an AI large model for processing enterprise user data and service agency user data, generating state analysis parameters for enterprise users and service agency users, so as to complete the automatic allocation of the service party involved in the current working node in the workflow in the intelligent workflow allocation module 30243, thereby further completing the generation of the workflow authorization file. As a server background, the AI ​​server 3024 also performs parameter updates and structural optimization for the AI ​​modules in the enterprise browser client 301 and the service browser client 303, and can also perform allocation and collaborative calculation of analysis tasks.

[0064] The service browser client 301 includes an SDK toolkit, which contains: The display content module 3031 can receive the information of the first workflow node to be participated in the first workflow authorization file on the server side of the workflow data protection system, and display the relevant information of the workflow node to the service user, such as the progress of the work node, the authorization status, the data content to be processed, etc. It is presented to the user in an intuitive interface form, which is convenient for the user to understand the overall situation of the workflow and operate it, and displays the decrypted workflow file, and is convenient for the service user to process the work file, and can send the confirmation participation information of the first service party to the first workflow node to the server side of the workflow data protection system. After the confirmation of the content authorization module 3033, this module can use the encryption and decryption content module 3032 to display the decrypted content. If it does not meet the content authorization conditions, such as the authorization time has passed, the decryption operation cannot be performed. Preferably, in the service party browser client 303, the displayed content will also include a workflow generation module 30234 that provides an introduction to the workflow nodes in the workflow node that can be viewed by the service party who needs to be assigned a work node, and after confirming participation in the workflow node, the encryption factor ciphertext data and the corresponding ciphertext data encrypted using the service party's public key can be downloaded, so that subsequent decryption operations can be performed to participate in the workflow node.

[0065] Encryption and decryption content module 3032: responsible for obtaining the first ciphertext data, the first encryption factor ciphertext data, and the enterprise public key data and the first service party's public key in the first workflow node of the work file data to be processed uploaded by the enterprise party from the workflow data protection system server 302, wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the first service party public key in the first workflow authorization file; decrypting the first encryption factor ciphertext data according to the first service party private key of the first service party on the user client side to obtain the first encryption factor; using the first encryption factor to decrypt the first ciphertext data to obtain the work file data to be processed, so that the work file data to be processed can be displayed in the presentation content module 3031, and then the file data is processed to obtain the first work file data. Next, the encryption and decryption content module 3032 generates a second encryption factor; encrypts the first work file data according to the second encryption factor to obtain second ciphertext data; encrypts the second encryption factor according to the enterprise party public key data in the first workflow node to obtain second encryption factor ciphertext data; encrypts the second encryption factor according to the first service party public key to obtain third encryption factor ciphertext data, and uploads the second ciphertext data, the second encryption factor ciphertext data, and the third encryption factor ciphertext data to the workflow data protection system server and stores them in correspondence with the first workflow authorization file; wherein the second ciphertext data and the second encryption factor ciphertext data correspond to the enterprise party user public key in the first workflow node, and the second ciphertext data and the third encryption factor ciphertext data correspond to the first service party public key in the first workflow node. For example: the enterprise party at the current node in the authorization file can record the storage path information of the second ciphertext data and the second encryption factor ciphertext data uploaded by it, and store them in correspondence with the enterprise party public key of the authorization file. For example, the storage path information of the uploaded second ciphertext data and the third encryption factor ciphertext data can be recorded at the service side at the current node in the authorization file, and stored correspondingly with the first service side public key of the authorization file. These storages are all processed in the workflow data protection system server 302. At the same time, it is also used to obtain the ciphertext data and encryption factor ciphertext data corresponding to the service side public key at the current working node from the workflow data protection system server 302, and use the service side's private key to perform decryption operations on the service side client.

[0066] Preferably, when the encryption and decryption content module 3032 detects that the first service user accesses the workflow data protection system server for the first time, the service user client-side encryption and decryption content module 3032 obtains the service user's public key and service user's private key that can be used for asymmetric encryption and decryption by the service user; stores the service user's private key on the client side; and uploads the service user's public key to the workflow data protection system server-side user public key hosting module 30213 for management and storage.

[0067] Content authorization module 3033: manages the authorization-related affairs of the file data of the service party user in the workflow, interacts with the workflow data protection system server, performs operations such as applying for authorization to view the work file authorized by the enterprise party, viewing the authorization scope, etc., and coordinates with the display content module 3031 and the encryption and decryption content module 3032. Preferably, before obtaining the first ciphertext data of the work file data to be processed uploaded by the enterprise party in the first workflow node, the first encryption factor ciphertext data, and the enterprise party public key data and the first service party public key in the first workflow node, the content authorization module 3033 is configured to check whether the first service party user meets the status condition described in the authorization content in the first workflow authorization file; if the authorization status of the service party user does not meet the condition, the first ciphertext data of the work file data to be processed uploaded by the enterprise party, the first encryption factor ciphertext data, and the enterprise party public key data and the first service party public key in the first workflow node are prevented from being sent to the service party user client 303.

[0068] Preferably, the content authorization module 3033 can be configured to allow the service-side user to initiate a request to update the service provider; obtain the service provider who provides the work service in the same work node; notify the workflow data protection system server 302 to update the service-side information in the first workflow node in the first workflow authorization file to the newly selected first service provider information; obtain the public key data of the first service provider; use the public key data of the first service provider to encrypt the first encryption factor on the service-side user client through the encryption and decryption content module 3032 to obtain the fourth encryption factor ciphertext data; upload the first ciphertext data and the fourth encryption factor ciphertext data to the workflow data protection system server and save them in correspondence with the public key data of the first service provider in the first workflow node in the first authorization file.

[0069] Monitoring tool 3034: monitors the status of the workflow in real time, including the upload and download progress of the service user's work file data, the server connection status, the service node's service execution status, the editing time in the work file, etc., and feeds this information back to the AI ​​module 3035 or the workflow data protection system server, and after analysis, it is displayed to the enterprise user or the service user, so that users can promptly understand whether the workflow is running normally and the user's processing status, thereby increasing transparency.

[0070] Preferably, the monitoring tool 3034 is configured to monitor the working status information of the first service party; send the working status information to the AI ​​module 3035 and the AI ​​server 3024 for analysis to obtain the workflow node information that needs to be adjusted in the first workflow authorization file; adjust the authorization allocation content in the workflow node of the first workflow authorization file, and update the first workflow authorization file; notify the service party user and the enterprise party user of the change information of the workflow node in the first workflow authorization file.

[0071] Preferably, the monitoring tool 3034 is configured to monitor the working status information of the first service party; the working status information is sent to the AI ​​module 3035 and the AI ​​server 3024 for analysis to obtain the service resources and / or service tool information required by the service party in the current workflow node; the entry for loading the service resources and / or service tool information is on the user client side of the first service party.

[0072] Preferably, the monitoring tool 3034 is configured to communicate with the user status supervision module 30212 and then with the monitoring tool 3015, so as to finally monitor the working status information of the enterprise party in the first workflow node; send the working status information to the AI ​​server 3024 for analysis to obtain feedback information from the enterprise party user; send the feedback information from the enterprise party user to the user client side of the first service party in the current working node; and adjust the processing method of the working file data according to the feedback information from the enterprise party user.

[0073] Preferably, the monitoring tool 3034 is further configured with an encryption security assessment module (not shown), which notifies the encryption and decryption content module 3032 to adjust the encryption strength of the data according to the sensitivity of the workflow data and the security assessment of the current working environment. The encryption security assessment module monitors the type of workflow data in real time (such as documents involving commercial secrets and core technologies are considered highly sensitive data, and general transactional files are considered low-sensitivity data), the network environment security of data transmission (such as the encryption strength is automatically increased in a public network environment, and the encryption strength can be appropriately reduced in an enterprise internal security network environment to improve efficiency) and the security status of the device where the service party is located (such as whether the device is installed with the latest security protection software, whether there are security vulnerabilities, etc.), and the client dynamically selects a suitable encryption algorithm and key length to achieve adaptive adjustment of encryption strength. Preferably, the service party user client regularly obtains the latest security policy and encryption algorithm library updates from the third-party security server to maintain the ability to respond to new security threats, and synchronizes them to the encryption and decryption content module 3032 for encryption execution. Preferably, the monitoring tool 3034 of the service party browser client continuously analyzes the characteristics of the workflow data during the workflow operation. For example, when the service provider processes a document containing the core technical information of the enterprise, the monitoring tool identifies the high sensitivity of the data; at the same time, the network environment is detected. If it is found that the current environment is a public wireless network and the device is not installed with the latest firewall software, the client determines that the current security risk is high. According to the security assessment results, the encryption and decryption content module selects a high-strength encryption algorithm (such as AES-256 bit encryption algorithm) from the encryption algorithm library to encrypt the work data. The encryption algorithm library is regularly updated through a connection with a third-party security server to ensure that the client has the latest encryption algorithm and security policy. If the service user is processing general transaction files and is in the internal security network environment of the enterprise, in order to improve work efficiency, the service user can manually set a lower encryption strength lower limit. At this time, the client selects a relatively efficient encryption algorithm (such as AES-128 bit encryption algorithm) on the premise of ensuring basic security. During the encryption process, the client records the relevant information of the encryption strength adjustment (such as the adjustment time, adjustment reason, previous and next encryption algorithms and key length, etc.) for subsequent auditing and security analysis. When the working environment or data type changes, the client can respond in time, re-evaluate and adjust the encryption strength to ensure the balance between data security and processing efficiency in different scenarios.

[0074] AI module 3035: Use artificial intelligence technology to perform large-scale model analysis on the data collected by monitoring tool 3034, such as intelligent analysis of the work data of service users, predicting possible problems in the workflow or providing optimization suggestions, and assisting the workflow to execute more smoothly. This module communicates with the workflow data protection system server 302 to update and manage the parameters of its AI model, synchronize with the AI ​​server on the server side, and then realize edge AI computing on the client to meet the fast AI computing of service users on the client side, and communicate and synchronize the calculation results with other modules and the workflow data protection system server. Preferably, the AI ​​module 3035 is configured to obtain the first official electronic message content through the network interface; trigger the first workflow initiation request of the first service provider according to the identified first official electronic message content; and further obtain the public key data of the first service provider of the current working node in the second workflow node and the public key data of the enterprise user from the second workflow authorization file generated according to the first workflow initiation request on the server side of the workflow data protection system by calling the encryption and decryption content module 3032; generate a third encryption factor; encrypt the first official electronic message content according to the third encryption factor to obtain the third ciphertext data; The third encryption factor is encrypted according to the enterprise user's public key to obtain the fifth encryption factor ciphertext data; the third encryption factor is encrypted according to the first service provider's public key to obtain the sixth encryption factor ciphertext data; the third ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data are uploaded to the workflow data protection system server and saved in correspondence with the second workflow authorization file; wherein the third ciphertext data and the fifth encryption factor ciphertext data correspond to the enterprise user's public key in the second workflow authorization file, and the third ciphertext data and the sixth encryption factor ciphertext data correspond to the first service provider's public key in the second workflow authorization file.

[0075] Preferably, the AI ​​module 3035 is further configured to include a big data analysis module (not shown), which obtains the user data of the service provider through the monitoring tool 3034 for analysis and processing. For example, before the service provider user initiates a new workflow based on the official letter, the big data analysis module collects the service provider's internal historical workflow data, similar business workflow cases in the same industry, and market trend information. Through in-depth analysis of these data, the problems and bottlenecks that may be encountered in this workflow are predicted, and the optimal workflow path opinions are planned in advance and sent to the workflow data protection system server 302 synchronously. For example, in the workflow of the OA examination opinion reply of the patent application, according to the average time consumption, success rate and possible examination opinion types of different types of patent OA reply processes at each node in the historical data, a personalized workflow plan is formulated for the current application, including recommending appropriate service provider service information, estimating the completion time of each node, etc. The big data analysis module (not shown) further uses machine learning algorithms to learn the business model and work habits of the service provider user, and automatically identifies the key decision points and optimizable links in the workflow. For example, if the service provider frequently applies for patent portfolio layout, the system will recognize this pattern and automatically arrange relevant patent search and analysis nodes during workflow pre-planning to improve the quality and success rate of the patent portfolio.

[0076] Preferably, the AI ​​module 3035 is further configured to include an intelligent workflow assistant module (not shown), which uses natural language processing (NLP) and machine learning technology to provide real-time workflow guidance and prompts for service users. Service users can interact with the intelligent assistant through voice or text to ask any questions about the workflow, such as the next operation of the current node, the list of materials to be submitted, the estimated completion time, etc. The intelligent assistant provides users with personalized suggestions and solutions based on the real-time status of the workflow, the user's historical operation records, and the best practice cases in the knowledge base. For example, in the patent application process, when the user asks whether the patent application conditions are met, the intelligent assistant will analyze the type and key points of the consulting question, and combine the service provider's past similar cases and common industry response strategies to generate detailed processing ideas and reference materials for the service user. Further, the intelligent workflow assistant module predicts possible risk events in the workflow, such as the risk of patent application rejection, enterprise default risk, data leakage risk, etc., through real-time analysis and learning of workflow data. It is based on a risk assessment model, taking into account multiple factors such as the progress of workflow nodes, official policy changes, and the credit record of the enterprise, to calculate the risk probability and impact. When the risk probability exceeds the preset threshold, the intelligent assistant sends warning information to the service user, including the risk type, possible impact range, and recommended countermeasures. For example, if it is predicted that a patent application may be rejected due to insufficient comparative analysis of prior art, the intelligent assistant will remind the user to supplement relevant technical information in a timely manner or consider adjusting the application strategy, and provide specific operational guidance and resource recommendations (such as recommending professional patent search services or technical expert consultation).

[0077] Preferably, the AI ​​module 3035 is further configured to include a workflow adaptive adjustment module (not shown). During the execution of the workflow, the service party browser client continuously monitors the workflow status (such as data upload and download speed, service party processing progress, official communication response time, etc.) and external environment changes (such as legal and regulatory updates, industry technology breakthroughs, etc.) through the monitoring tool 3034. When it is found that the actual situation deviates from the pre-planned path or the external environment changes significantly, the workflow adaptive adjustment mechanism is automatically triggered. The adjustment mechanism is based on a dynamic programming algorithm, recalculates the priority, resource allocation and time arrangement of each node in the workflow, and requests the workflow data protection system server 302 to update the authorization file content to implement the above adjustment mechanism. For example, if a service party is significantly behind in the progress of the node of writing the first draft of the patent application, the system will automatically evaluate whether it is necessary to increase resources (such as allocating more manpower or extending the authorization time) or adjust the order of subsequent nodes (such as conducting part of the review work first while waiting for the first draft to be completed) to ensure that the efficiency and quality of the entire workflow are not affected.

[0078] Embodiment 4: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a fourth embodiment to illustrate the process of the service provider user updating the service provider in the third embodiment of the present invention. Figure 4 This is a workflow diagram of a service provider user updating a service provider's service provider in Embodiment 3 of the present invention.

[0079] See also Figure 4 In this embodiment, the workflow process of the service provider user updating the service provider is as follows: The service-side user initiates a request to update the service provider: During the execution of the workflow, if the first service-side user finds that the service provider of the current service provider cannot meet the work requirements (such as substandard service quality, low processing efficiency, etc.) or needs to replace the service provider for other reasons, he clicks the "Update Service Provider" button (the button is located in the display content module 3031) on the operation interface of the browser client of the first service provider to start the process of updating the service provider. At this time, the content authorization module 3033 of the service-side client will generate an update request information including the service-side user ID (identifying the current service provider), the workflow node ID, and the update reason (such as "poor service quality", "business demand change", etc.).

[0080] Get the service providers and service personnel who provide the work service in the same work node: The service party browser client sends the update request information to the workflow data protection system server (the sending process uses the server-side public key encryption to ensure information security). After receiving the request, the server queries the database for other service providers and service personnel who can provide the same work node service according to the workflow node information and pre-set screening rules. This information includes the name of the service provider, the name of the service person, the service qualification, the historical service evaluation and other content. The server organizes the queried service provider and service personnel information into a list, and then encrypts the list using the service party user public key, and then sends it back to the service party browser client.

[0081] Notify the workflow data protection system server to update the service provider information in the first workflow node in the first workflow authorization file to the newly selected first service provider service person information: After the first service provider user receives the encrypted service provider service person information list on the client, he uses the private key to decrypt and view it. According to the information in the list, the user selects a suitable new service provider service person (i.e., the first service provider service person information). The content authorization module 3033 of the service provider client encrypts the new service provider service person information (including service person identification, affiliated service provider, etc.) selected by the user again and sends it to the workflow data protection system server, notifying the server to update the service provider information in the first workflow authorization file. After receiving the notification, the server finds the corresponding first workflow authorization file in the authorization file management module 30215, and updates the service provider information of the first workflow node therein to the newly selected first service provider service person information. Preferably, each service provider service person has its own corresponding public and private keys to perform encryption and decryption processing on the work data of this service provider service person.

[0082] Obtaining the public key data of the first service provider: After updating the authorization file, the server obtains the public key data of the first service provider from the user public key escrow module 30213. After obtaining the public key data, the server encrypts it with the service party user public key to ensure the security of the public key during transmission, and then sends the encrypted public key data to the service party browser client.

[0083] The first encryption factor is encrypted on the service side user client using the public key data of the first service provider to obtain the ciphertext data of the fourth encryption factor: After the service side browser client receives the encrypted public key data K1 of the first service provider, it uses its private key to decrypt and obtain the public key data K1. Preferably, the public key data of the first service provider can also be transmitted to the service side browser client without encryption, so that the service side browser client does not need to use its private key to decrypt and obtain the public key data. At this time, the encryption and decryption content module 3032 of the client obtains the first encryption factor a in the current workflow (the encryption factor is previously generated and stored locally when processing the work file data. Preferably, if it does not exist, it can be regenerated, and it will not be repeated here), and the first encryption factor is encrypted using the public key of the first service provider to obtain the ciphertext data B4 of the fourth encryption factor. The encryption process follows the rules of the public key encryption algorithm (such as the RSA algorithm) to ensure that the encrypted ciphertext data of the fourth encryption factor can only be decrypted by the first service provider using its private key.

[0084] The first ciphertext data and the fourth encryption factor ciphertext data are uploaded to the workflow data protection system server and saved in correspondence with the public key data K1 of the first service provider in the first workflow node in the first authorization file: the encryption and decryption content module 3032 combines the first ciphertext data A1 already in the current workflow node (i.e. the encrypted data A1 of the work file data A to be processed uploaded by the enterprise) and the newly generated fourth encryption factor ciphertext data B4 into an upload data packet. The necessary identification information such as the service provider identification, workflow node identification, and upload timestamp are added to the data packet, and then the server-side public key is used to encrypt the data packet (to further enhance the security of data transmission, preferably, the server-side public key can also be omitted to encrypt the data packet). After encryption, the data packet is uploaded to the workflow data protection system server through a secure network connection. After receiving the encrypted data packet, the server-side uses its private key to decrypt it and associates the data with the first authorization file X1 according to the identification information and saves it. During the saving process, a corresponding relationship between the data and the public key data K1 of the first service provider of the first workflow node in the first authorization file X1 is established to ensure that the first service provider can use its private key to accurately obtain and process the corresponding data later.

[0085] Embodiment five: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a fifth embodiment to illustrate the process of monitoring the working status of the service provider in the third embodiment of the present invention. Figure 5 This is a schematic diagram of a workflow process for monitoring the working status of a service provider in Embodiment 3 of the present invention.

[0086] See also Figure 5 In this embodiment, the workflow process of monitoring the service provider's working status for processing is disclosed as follows: Monitoring the working status information of the first service provider: The monitoring tool 3034 in the browser client of the service provider monitors the working status of the first service provider in real time. The monitoring content covers the upload and download progress of the working file data of the service provider user (such as displaying the percentage of the current file upload, download speed, etc.), the connection status with the server (by regularly sending heartbeat packets to detect whether the connection is normal, if abnormal, displaying specific error information, such as network interruption, server busy, etc.), the execution status of the service person of the working node (recording the time when the service person starts to process the task, the time point when the specific operation is completed, and marking it as abnormal if it exceeds the expected time) and the duration of editing the working file (counting the total duration from opening the file for editing to the final saving, so as to analyze the work efficiency) and other information. These monitoring data will be recorded in real time and stored in the local cache for subsequent analysis.

[0087] According to the work status information sent to the AI ​​module for analysis, the workflow node information that needs to be adjusted in the first workflow authorization file is obtained: the monitoring tool 3034 sends the collected work status information to the AI ​​module 3035 at a preset time interval (such as every 5 minutes) or when a specific event is triggered (such as the completion of the upload and download of the work file data, the completion of an important operation by the service person, etc.). After receiving the data, the AI ​​module 3035 uses the built-in artificial intelligence algorithm and model (such as a workflow analysis model based on deep learning) to conduct an in-depth analysis of the data. During the analysis process, the AI ​​module 3035 will compare the current work status data with historical data, industry standard data, and preset workflow rules. For example, if it is found that the service user takes significantly longer than the historical average time or industry standard time to process a certain type of work file, and the upload and download progress is slow, the AI ​​module 3035 may determine that there is an efficiency problem with the workflow node and it needs to be adjusted. For example, if it is detected that the connection between the service person and the server is frequently interrupted, the AI ​​module 3035 will consider whether it is necessary to optimize the network configuration or adjust the execution order of the workflow nodes to reduce the amount of data transmission. Based on the analysis results, AI module 3035 generates a report on the workflow node information that needs to be adjusted in the first workflow authorization file. The report includes the node number, adjustment suggestions (such as optimizing resource allocation, changing processing methods, adjusting node order, etc.) and the basis for adjustment (such as data analysis results, comparison standards, etc.).

[0088] Adjust the authorization allocation content in the workflow node of the first workflow authorization file and update the first workflow authorization file: The AI ​​module 3035 sends the generated adjustment report to the AI ​​server 3024 on the server side of the workflow data protection system. The enterprise user data collection and analysis module 30241 and the service agency user data collection and analysis module 30242 in the AI ​​server 3024 will further review and analyze the report, and determine the final adjustment plan in combination with the overall situation of the enterprise and the service party (such as the business priority of the enterprise party, the resource availability of the service party, etc.). Then, the authorization description content generation module 30232 modifies the authorization allocation content of the workflow node in the first workflow authorization file according to the adjustment plan, such as reallocating resource permissions (such as increasing or decreasing the service party's access rights to specific data), adjusting time permissions (such as extending or shortening the service party's operation time limit at a certain node), etc. After the modification is completed, the workflow authorization file server 3023 stores the updated first workflow authorization file and notifies the relevant enterprise browser client 301 and service party browser client 303.

[0089] Notify the service-side user and the enterprise-side user of the change information of the workflow node in the first workflow authorization file: The workflow data protection system server sends a workflow node change notification to the service-side browser client 303 and the enterprise-side browser client 301 through a message push mechanism (such as using WebSocket technology to achieve real-time push). The notification content includes the changed node information (such as node number, name, main differences before and after the change, etc.), the reason for the change (such as improving work efficiency, optimizing resource allocation, etc.) and the expected effect after the change (such as shortening the total duration of the workflow, improving work quality, etc.). After receiving the notification, the display content module 3031 of the service-side browser client 303 and the display content module 3011 of the enterprise-side browser client 301 will display it to the user in a striking manner such as a pop-up window, a message prompt bar, etc., to ensure that the user can understand the changes in the workflow node in a timely manner. At the same time, the client will update the workflow-related information stored locally so that the user can follow the new workflow rules in subsequent operations.

[0090] Embodiment six: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses a sixth embodiment to illustrate the workflow process of loading service resources and service tools in the third embodiment of the present invention.

[0091] The workflow process for loading service resources and service tools in this embodiment is as follows: Monitoring the working status information of the first service provider: The monitoring tool 3034 in the browser client of the service provider continuously tracks and monitors the various operations and status of the first service provider in the workflow. Specifically, it includes the operation behavior of the service provider user when processing the work file (such as frequently used functional modules, time interval distribution of operations, etc.), the processing progress of the work file data (such as the proportion of completed workload, remaining workload estimation, etc.), the current system resources used (such as CPU usage, memory usage, etc.), and the frequency and content of interaction with other related parties (such as the enterprise party, other service providers). These monitoring data are collected in real time and organized into a structured data format for subsequent analysis and processing.

[0092] According to the work status information, it is sent to the AI ​​module for analysis to obtain the service resources and / or service tool information required by the service party in the current workflow node: the monitoring tool 3034 sends the collected work status information to the AI ​​module 3035 according to a certain time period (for example, every 10 minutes) or when a specific event is triggered (such as the workflow node entering a critical stage, the service party user requests resource recommendation, etc.). After receiving the data, the AI ​​module 3035 uses its built-in intelligent analysis algorithm and pre-trained model (such as a resource demand prediction model based on machine learning) to deeply mine and analyze the data. By identifying the operation behavior pattern of the service party user, extracting the characteristics of the work file data, and analyzing the trend of system resource usage, the AI ​​module predicts the service resources and / or service tools that the service party may need in the current workflow node. For example, if the AI ​​module finds that the CPU usage rate of the service party user is continuously high and the processing speed is slow when processing a work file with a large amount of image data, it may recommend the use of hardware resources such as graphics processing acceleration cards; if it is analyzed that the service party user frequently performs text editing and format conversion operations, it may recommend the provision of professional document processing tools or plug-ins. The AI ​​module will organize the resource and tool recommendation information obtained through analysis to form a detailed report. The report content includes the recommended resource / tool ​​name, function description, acquisition method, and recommendation basis and priority.

[0093] The entry for loading service resources and / or service tool information is on the user client side of the first service party: the AI ​​module 3035 sends the resource and tool recommendation report back to the service party browser client. After receiving the report, the client's display content module 3031 presents the recommended service resources and / or service tool information to the service party user in an intuitive manner (such as list display, icon prompt, etc.). At the same time, a corresponding loading entry (such as a button, link, etc.) is generated on the client interface to facilitate users to directly obtain the required resources and tools. If the recommendation is a software tool or plug-in, the client will automatically detect whether the local environment meets the installation requirements and provide a one-click installation or download link; if it is a hardware resource recommendation, the client will provide resource configuration guidance and relevant supplier information to help the service party user upgrade or purchase resources. The service party user can choose whether to load the recommended resources and tools according to their own needs and actual conditions, thereby improving work efficiency and quality.

[0094] Preferably, the loaded service resources and / or service tool information are: AI-driven patent search tools and / or AI-assisted patent technical solution writing tools. AI module 3035 can also preferably integrate AI-driven patent search tools and / or AI-assisted patent technical solution writing tools. For example: AI module 3035 uses natural language processing technology to perform in-depth semantic analysis of patent writing needs during the patent search stage. Decompose the text content such as technical briefing documents or invention ideas provided by the enterprise into semantic elements such as key concepts, technical features, and application scenarios. Then, based on these semantic elements, a comprehensive search is performed in multiple patent databases (including domestic and foreign official patent databases, professional commercial patent databases, and academic research databases, etc.) at the same time. AI module 3035 automatically generates templates and frameworks suitable for current patent writing needs by conducting in-depth learning on a large number of similar patent cases (including successfully authorized and innovative cases). For example, for software patent writing, according to the characteristics of different types of software (such as operating system software, application software, embedded software, etc.) and common technical solution structures, corresponding writing templates are generated, including standard formats and key content prompts for technical fields, background technologies, invention contents, and illustrations. According to the content of the enterprise's technical briefing and the relevant patents retrieved, the most suitable writing templates and reference cases are intelligently recommended. Based on the analysis and understanding of existing patent technologies, AI module 3035 conducts an innovative evaluation of the technical solutions written by the service provider. By comparing with the retrieved patents, the innovative points in the technical solutions are identified, and their novelty and creativity are evaluated.

[0095] Embodiment seven: In order to more clearly explain the detailed operation details of the workflow data processing system in the third embodiment of the present invention, the following uses a seventh embodiment to illustrate the workflow process of monitoring the working status of the enterprise party and performing processing in the third embodiment of the present invention.

[0096] The workflow process for monitoring the working status of the enterprise side and performing processing in this embodiment is disclosed as follows: Monitoring the working status information of the enterprise in the first workflow node: The monitoring tool 3034 of the browser client of the service party establishes a communication connection with the user status supervision module 30212 of the workflow data protection system server to obtain the relevant working status information of the enterprise in the first workflow node. This information includes the operation records of the enterprise user on the work file (such as the time and content of the operation of viewing, modifying, annotating, etc.), the communication and interaction between the enterprise and other relevant parties (such as the service party and other enterprise partners) (such as email exchanges, instant messaging records, etc., if privacy is involved, only summary information such as interaction frequency and key topics can be obtained), the decision time and decision results of the enterprise in the workflow node (such as whether to approve the file submitted by the service party, whether to agree to enter the next workflow node, etc.), and the login time and activity of the enterprise in the system. The monitoring tool 3034 preliminarily organizes and classifies these original information, removes redundant data, extracts key features, and forms structured data for analysis.

[0097] According to the work status information, it is sent to the AI ​​module for analysis to obtain the feedback information of the enterprise user: the monitoring tool 3034 sends the sorted work status information of the enterprise to the AI ​​module 3035. The AI ​​module 3035 uses advanced natural language processing technology (such as text classification, sentiment analysis algorithm) and machine learning models (such as user behavior prediction models based on deep learning) to conduct in-depth analysis of the enterprise's operation records, communication content and other data. For example, by performing sentiment analysis on the textual expressions of the enterprise in the document annotations, the satisfaction of the enterprise with the service party's work results can be judged (such as positive annotations may indicate satisfaction, while annotations containing more modification suggestions or negative words may indicate dissatisfaction); according to the decision time and decision results of the enterprise, the expectations of the enterprise for the progress and quality of the workflow can be predicted; by analyzing the communication and interaction between the enterprise and other parties, the potential feedback information of the enterprise in terms of business needs, willingness to cooperate, etc. can be mined. The AI ​​module 3035 combines these analysis results to generate a feedback information report of the enterprise user, which covers the enterprise's evaluation of the service party's work, opinions on the progress of the workflow, and possible business adjustment needs.

[0098] Send the feedback information of the enterprise user to the user client side of the first service party in the current working node: AI module 3035 sends the generated feedback information report to AI server 3024 on the server side of the workflow data protection system through a secure communication channel (such as an encrypted network connection). AI server 3024 further reviews and optimizes the feedback information (such as ensuring the accuracy and completeness of the information and removing possible misjudgment information), and then pushes it to the service party browser client 303. After receiving the feedback information, the display content module 3031 of the service party browser client 303 displays the enterprise feedback content to the first service party user in a clear and understandable manner (such as popping up a detailed feedback information window, displaying eye-catching prompt information in the workflow interface, etc.), ensuring that the service party user can understand the opinions and needs of the enterprise in a timely and accurate manner.

[0099] Adjust the processing method of work file data according to the feedback information from the enterprise users: First, after viewing the feedback information from the enterprise, the service user will make corresponding adjustments to the processing method of the work file data according to the feedback content. If the enterprise feedback is not satisfied with a part of the work file, the service user will focus on modifying and improving that part, which may involve re-investigation, rewriting the content, adjusting the data format, etc.; if the enterprise proposes new business needs or work requirements, the service user will evaluate its own capabilities and resources to decide whether it is necessary to adjust the workflow, increase manpower, or seek external support to meet the needs of the enterprise. In the process of adjusting the processing method of work file data, the service user can use the various tools (such as document editing tools, data analysis tools, etc.) and resources (such as reference materials, historical data, etc.) provided by the client, and maintain close communication with the enterprise (such as through the client's built-in instant messaging function or email system), and promptly feedback the progress and results of the adjustment to ensure that the processing of work file data can meet the expectations of the enterprise and promote the smooth progress of the workflow.

[0100] Embodiment eight: In order to more clearly explain the details of the operation of the workflow data processing system in the third embodiment of the present invention, the following uses an eighth embodiment to illustrate the process of initiating a new workflow after official document recognition in the third embodiment of the present invention. Figure 6 This is a flow chart of initiating a new workflow after official document recognition in Embodiment 3 of the present invention.

[0101] See also Figure 6 In this embodiment, the process of initiating a new workflow after official document recognition is disclosed as follows: Obtaining the content of the first official electronic message through the network interface: The AI ​​module 3035 of the browser client of the service party monitors whether there is a new first official electronic message arriving through the network interface (such as a dedicated email receiving interface, an electronic government platform data interface, etc.) regularly (such as every 1 hour) or in real time (if it has real-time monitoring capabilities). Once a new message is detected, the client uses a preset security protocol (such as the HTTPS protocol) to establish a connection with the message source server, and after passing the identity authentication (such as using the service party's digital certificate or account password for login verification), it downloads the electronic message content. During the download process, the client performs an integrity check on the message (such as calculating the hash value of the file and comparing it with the hash value provided by the server) to ensure that the message has not been tampered with during transmission. The message content can be in various formats, such as PDF, XML, HTML, etc. The client will perform corresponding parsing and preprocessing according to the file format, convert it into a processable text data format, extract key information (such as file title, document number, issuing unit, main content, etc.), and store it in the local cache for subsequent analysis.

[0102] According to the identified content of the first official electronic communication, the first workflow initiation request of the first service provider is triggered: AI module 3035 performs in-depth analysis and identification on the obtained content of the first official electronic communication. The type of communication (such as patent examination opinion notice, patent authorization notice, official fee payment notice, etc.) and the importance (such as urgent, important, general, etc.) are judged by using natural language processing technology (such as keyword extraction, semantic analysis, text classification algorithm) and pre-trained business rule models (such as official communication classification models for patent affairs). According to the type and importance of the communication, combined with the workflow triggering rules pre-set by the service provider (such as automatically triggering the patent reply workflow for the patent examination opinion notice; triggering the patent certificate collection workflow for the patent authorization notice, etc.), the AI ​​module generates a first workflow initiation request. The request information includes key information of the communication (such as document number, type, etc.), the service provider's identification, the context information of the current workflow (such as basic information of the relevant patent application, the execution status of the previous workflow, etc.), and the timestamp of the request initiation. The AI ​​module sends the initiation request to the workflow generation module 30233 on the server side of the workflow data protection system.

[0103] From the second workflow authorization file generated by the workflow data protection system server side according to the first workflow initiation request, obtain the public key data of the first service provider of the current working node in the second workflow node and the public key data of the enterprise user: After receiving the first workflow initiation request, the workflow generation module 30233 generates the second workflow authorization file X2 according to the information in the request and the preset workflow template (such as matching the corresponding workflow template for different types of official letters). The authorization file contains the detailed structure of the new workflow, the information of the enterprise party and service party involved, the task allocation and permission setting of each workflow node, etc. In the process of generating the authorization file, the workflow generation module 30233 obtains the public key data K1 of the first service provider and the public key data K2 of the enterprise user from the user public key escrow module 30213, and embeds them into the corresponding position of the second workflow authorization file (such as in the workflow node involving data encryption and decryption, explicitly specify the public key to be used). Then, the workflow generation module 30233 stores the generated second workflow authorization file X2 in the workflow authorization file server 3023, extracts the public key data therein, encrypts it using the service party user public key (to ensure the security of the public key data during transmission), and then sends the encrypted public key data back to the service party browser client.

[0104] Generate the third encryption factor: After the service party browser client receives the encrypted public key data, it uses the private key to decrypt and obtain the public key data of the first service party and the public key data of the enterprise user. At the same time, the encryption and decryption content module 3032 of the client calls a secure random number generation algorithm (such as a random number generator based on a hardware entropy source and a complex algorithm) to generate a third encryption factor. The length and strength of the third encryption factor are determined according to the security policy of the system and the sensitivity of the content of the message, for example, it can be a 128-bit, 192-bit or 256-bit random binary sequence. The generated third encryption factor will be used to encrypt the content of the first official electronic message to ensure the security of the data after uploading to the server and prevent the data from being obtained or tampered with by unauthorized parties.

[0105] The first official electronic message content is encrypted according to the third encryption factor to obtain the third ciphertext data: The encryption and decryption content module 3032 uses the third encryption factor a3 generated in step 4 and adopts a suitable encryption algorithm (such as the AES algorithm) to encrypt the first official electronic message content (which has been converted into a text data format). The text data is divided into data blocks of fixed length (such as 128 bits), and each data block is subjected to a specific operation (such as an XOR operation or an operation specified by other encryption algorithms) and the third encryption factor to generate an encrypted ciphertext data block, which is finally combined into a complete third ciphertext data A3. In this way, even if the data is intercepted during transmission or storage, the original data cannot be restored without the correct encryption factor, thereby ensuring the confidentiality of the message content.

[0106] The third encryption factor is encrypted according to the enterprise user's public key to obtain the fifth encryption factor ciphertext data: The encryption and decryption content module 3032 obtains the enterprise user's public key data K2 obtained from the server, and uses the public key to encrypt the third encryption factor a3. The encryption process follows the rules of the public key encryption algorithm (such as the RSA algorithm) to convert the third encryption factor into the ciphertext form corresponding to the enterprise user's public key, that is, the fifth encryption factor ciphertext data B5. In this way, the enterprise user can use its private key to decrypt and obtain the third encryption factor in the subsequent process, and then decrypt the third ciphertext data, so as to realize the secure sharing and interaction of data between the service party and the enterprise party.

[0107] The third encryption factor is encrypted according to the first service party's public key to obtain the sixth encryption factor ciphertext data: The encryption and decryption content module 3032 simultaneously uses the first service party's public key K1 (obtained and decrypted from the server) to encrypt the third encryption factor a3 to generate the sixth encryption factor ciphertext data B6. The purpose of this step is to retain the service party's encryption record of the data in the workflow so that it can be audited or verified when necessary. For example, during data integrity checks or dispute resolution, the consistency of the ciphertext data of different encryption factors can be compared to ensure the correctness and reliability of the data processing process.

[0108] The third ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data are uploaded to the workflow data protection system server and stored in correspondence with the second workflow authorization file; wherein the third ciphertext data and the fifth encryption factor ciphertext data correspond to the enterprise user public key in the second workflow authorization file, and the third ciphertext data and the sixth encryption factor ciphertext data correspond to the first service party public key in the second workflow authorization file: the encryption and decryption content module 3032 combines the third ciphertext data A3, the fifth encryption factor ciphertext data B5, and the sixth encryption factor ciphertext data B6 into an upload data packet, and adds necessary identification information (such as service party identification, workflow node identification, incoming document number, upload timestamp, etc.). Then, after encrypting the data packet using the server-side public key (to further enhance data transmission security), it is uploaded to the workflow data protection system server through a secure network connection. After receiving the encrypted data packet, the server-side uses the private key to decrypt it and stores the data in correspondence with the second workflow authorization file X2 according to the identification information. During the saving process, the corresponding relationship between the third ciphertext data A3, the fifth encryption factor ciphertext data B5 and the enterprise user public key data K2 is established; the corresponding relationship between the third ciphertext data A3, the sixth encryption factor ciphertext data B6 and the first service party public key K1 is established to ensure that in the subsequent workflow, the enterprise and service parties can use their respective private keys according to the authorization to accurately obtain and process the corresponding data, and realize the orderly management and secure sharing of workflow data. For example, in the patent affairs workflow, the server saves the data to a specific database table, and realizes the corresponding relationship between the data and the authorization file and the public key through field association, which facilitates the query and call of the data.

[0109] The system device embodiments described in the above embodiments are merely illustrative, wherein the units described as separate components may or may not be physically separated. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present embodiment without creative effort.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing workflow data, running on a user client side of a first service provider, comprising: Receive the first workflow node information to be participated in the first workflow authorization file on the workflow data protection system server; Sending confirmation participation information of the first service provider to the first workflow node; Acquire first ciphertext data of the work file data to be processed uploaded by the enterprise in the first workflow node, first encryption factor ciphertext data, and the enterprise public key data and the first service party public key in the first workflow node, wherein the first ciphertext data and the first encryption factor ciphertext data correspond to the first service party public key in the first workflow authorization file; Decrypting the first encryption factor ciphertext data according to the first service provider private key of the first service provider at the user client side to obtain the first encryption factor; Decrypting the first ciphertext data using the first encryption factor to obtain the working file data to be processed; Processing the work file data to be processed to obtain first work file data; generating a second encryption factor; Encrypting the first working file data according to the second encryption factor to obtain second ciphertext data; Encrypting the second encryption factor according to the enterprise party public key data in the first workflow node to obtain the second encryption factor ciphertext data; Encrypting the second encryption factor according to the first service provider's public key to obtain ciphertext data of the third encryption factor; The second ciphertext data, the second encryption factor ciphertext data, and the third encryption factor ciphertext data are uploaded to the workflow data protection system server and saved correspondingly to the first workflow authorization file; wherein the second ciphertext data and the second encryption factor ciphertext data correspond to the enterprise user public key in the first workflow node, and the second ciphertext data and the third encryption factor ciphertext data correspond to the first service party public key in the first workflow node.

2. The method according to claim 1, characterized in that The first workflow authorization file includes: At least one workflow node generated corresponding to the workflow transaction type; The enterprise party, service party and their respective public key data involved in each workflow node; Description of the corresponding authorization content of the enterprise and service provider involved in each workflow node.

3. The method according to claim 2, characterized in that The description of the authorized content includes: Whether the enterprise and service providers involved in each workflow node can encrypt and decrypt workflow files; and / or The authorization duration of the workflow files in each workflow node; and / or Whether the enterprise and service providers involved in each workflow node can initiate sub-authorization; and / or Payment worker node configuration.

4. The method according to claim 1, characterized in that: Further including: It is detected that the service-side user accesses the workflow data protection system server for the first time; Obtaining a public key and a private key of the service provider user that can be used for asymmetric encryption and decryption processing by the service provider user; The service user's private key is stored on the client side; The service-side user public key is uploaded to the workflow data protection system server for storage.

5. The method according to claim 1, characterized in that Further including: The service-side user initiates a request to update the service provider; Get the service provider who provides the work service in the same work node; Notify the workflow data protection system server to update the service provider information in the first workflow node in the first workflow authorization file to the newly selected first service provider service provider information; Obtain the public key data of the first service provider; Using the public key data of the service provider of the first service provider to encrypt the first encryption factor on the service side user client to obtain the ciphertext data of the fourth encryption factor; The first ciphertext data and the fourth encryption factor ciphertext data are uploaded to the workflow data protection system server and stored correspondingly to the public key data of the first service provider in the first workflow node in the first authorization file.

6. The method according to claim 1, characterized in that Further including: Monitoring the working status information of the first service provider; Send the work status information to the AI ​​module for analysis to obtain the workflow node information that needs to be adjusted in the first workflow authorization file; Adjusting the authorization allocation content in the workflow node of the first workflow authorization file, and updating the first workflow authorization file; Notify the service user and enterprise user of the change information of the workflow node in the first workflow authorization file.

7. The method according to claim 1, characterized in that Further including: Monitoring the working status information of the first service provider; The work status information is sent to the AI ​​module for analysis to obtain the service resources and / or service tool information required by the service provider in the current workflow node; The entry for loading the service resource and / or service tool information is on the user client side of the first service provider.

8. The method according to claim 1, characterized in that Before obtaining the first ciphertext data of the work file data to be processed uploaded by the enterprise in the first workflow node, the first encryption factor ciphertext data, and the enterprise public key data and the first service party public key in the first workflow node, the method further includes: Check whether the first service provider user meets the status condition described in the authorization content in the first workflow authorization file; If the authorization status of the service user does not meet the conditions, the first ciphertext data of the work file data to be processed uploaded by the enterprise, the first encryption factor ciphertext data, and the enterprise public key data and the first service party public key in the first workflow node are prevented from being sent to the service user client.

9. The method according to claim 1, characterized in that: Further including: Monitoring the working status information of the enterprise party in the first workflow node; The work status information is sent to the AI ​​module for analysis to obtain feedback information from enterprise users; Sending the feedback information of the enterprise user to the user client side of the first service party in the current working node; Adjust the processing method of the work file data according to the feedback information from the enterprise users.

10. The method according to claim 1, characterized in that Further including: Obtain the first official electronic communication content through the network interface; Triggering a first workflow of a first service provider to initiate a request based on the identified content of the first official electronic communication; Obtain the public key data of the first service provider of the current working node in the second workflow node and the public key data of the enterprise user from the second workflow authorization file generated by the workflow data protection system server side according to the request initiated by the first workflow; generating a third encryption factor; Encrypting the first official electronic message content according to the third encryption factor to obtain third ciphertext data; Encrypting the third encryption factor according to the enterprise user's public key to obtain ciphertext data of the fifth encryption factor; Encrypting the third encryption factor according to the first service provider's public key to obtain ciphertext data of the sixth encryption factor; Upload the third ciphertext data, the fifth encryption factor ciphertext data, and the sixth encryption factor ciphertext data to the workflow data protection system server and store them in correspondence with the second workflow authorization file; The third ciphertext data and the fifth encryption factor ciphertext data correspond to the enterprise user public key in the second workflow authorization file, and the third ciphertext data and the sixth encryption factor ciphertext data correspond to the first service provider public key in the second workflow authorization file.

Images