Workflow permission control method and system based on quantum encryption mechanism

Abstract

The application discloses a kind of workflow authority control method and system based on quantum encryption mechanism.Method includes: in response to the application submitted, obtain first quantum flow key and first quantum group key;According to the first quantum flow key, the business data of application is encrypted;According to the first quantum group key, the authority data of application is encrypted;In response to the approval request of application, according to the first quantum group key, the authority data is decrypted, and the approval authority of the approval request object is determined;According to the approval authority, the business data is decrypted with the first quantum flow key.In this way, when approving, first decrypt the authority data through the first quantum group key to verify the authority, then decrypt the business data as needed with the first quantum flow key, build pre-authorization protection, which can effectively intercept unauthorized access to information by non-approval person, to some extent solve the problem of non-approval person impersonating approval person to leak information, and protect the confidentiality of application information.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a workflow access control method and a workflow access control system based on quantum encryption mechanism. Background Technology

[0002] With the development of information technology, the demand for enterprise digital transformation, and the concept of process management, workflow systems are widely used in various business scenarios such as internal process automation, government approval, financial reimbursement, and contract processing. In workflow systems based on related technologies, approvers can typically process submitted applications at corresponding approval nodes. However, vulnerabilities in systems or terminals may allow unauthorized individuals to impersonate approvers and obtain application information, leading to the leakage of application information. Summary of the Invention

[0003] This application provides a workflow access control method and a workflow access control system based on quantum encryption mechanism.

[0004] The workflow access control method based on quantum encryption mechanism provided in this application includes: In response to the submitted application, obtain the first quantum process key and the first quantum set key; The application's business data is encrypted using the first quantum process key; The requested permission data is encrypted using the first quantum group key; In response to the approval request for the application, the permission data is decrypted according to the first quantum group key to determine the approval permission of the approval request object; Based on the approval authority of the approval request object, the business data is decrypted using the first quantum process key, so that the approval request object can approve the application.

[0005] Thus, by leveraging the quantum attack-resistant properties of the first quantum process key and the first quantum group key, the encryption protection of workflow data is strengthened from the source, reducing the risk of the first quantum process key and the first quantum group key being cracked or stolen to a certain extent. During the approval stage, the first quantum group key is used to decrypt permission data to verify permissions, constructing a pre-emptive permission protection barrier. This effectively intercepts unauthorized individuals impersonating approvers to obtain information, thus solving the problem of unauthorized individuals impersonating approvers and leaking information to a certain extent, thereby ensuring the confidentiality of application information and the overall security of the approval process.

[0006] In some implementations, the first quantum process key is generated based on a first workflow identifier, wherein the first workflow identifier is generated based on the workflow information of the application; The first quantum key is generated based on a first set of identifiers, wherein the first set of identifiers is generated based on the participants in the application.

[0007] In this way, each application workflow instance corresponds to a first quantum process key, and the authorization scope of the first quantum group key is limited according to the participants. This can effectively reduce the risk of batch data leakage under the traditional general key mode, thereby reducing the risk of application information being stolen to a certain extent, and thus ensuring the confidentiality of application information and the overall security of the workflow execution unit to a certain extent.

[0008] In some implementations, the step of decrypting the permission data based on the first quantum key and determining the approval permission of the approval request object in response to the approval request includes: In response to the approval request initiated by the approval request object, obtain the identity credentials of the approval request object and the first set of identifiers; Based on the identity credentials and the first set of identifiers, determine whether the approval request object has the approval authority.

[0009] Thus, through dual verification of identity credentials and the first set of identifiers, it prevents identity forgers from gaining permissions through single-role matching and also prevents legitimate individuals from approving cross-applications, effectively blocking the vulnerability of permission abuse from two dimensions. By strongly binding approval permissions to the specific set of participants in an application, compared to traditional global roles, the approval request object can only process applications within its own participating set and cannot access irrelevant application data, further narrowing the scope of security risks and ensuring the confidentiality of application information to a certain extent.

[0010] In some implementations, determining whether the approval request recipient has the approval authority based on the identity credential and the first set of identifiers includes: The identity credential is verified based on the identity credential and the first set of identifiers; If the verification passes, the first quantum group key is obtained based on the first set of identifiers; The permission data is decrypted using the first quantum key to determine whether the approval request object has the approval permission.

[0011] In this way, by linking the legitimacy of identity credentials with the actual content of the authorization data, the vague judgment of only verifying identity without confirming specific authorization is avoided. By decrypting the authorization data, the specific approval authority is clarified, rather than simply determining whether there is eligibility to participate. To a certain extent, it can accurately intercept requests from those who are eligible to participate but do not have the authorization to approve. This can effectively intercept unauthorized access to information by non-approval requesters and, to a certain extent, protect the confidentiality of application information.

[0012] In some implementations, the step of decrypting the business data based on the first quantum process key according to the approval authority of the approval requester, so that the approval requester can approve the application, includes: If it is determined that the object of the approval request has approval authority, the first quantum process key is obtained according to the first workflow identifier; All business data of the application is decrypted based on the first quantum process key, so that the approval request object can approve the application.

[0013] In this way, the subject and scope of business data decryption are strictly limited. Only the legitimate approval requester can obtain the first quantum process key of the application, and the first quantum process key can only decrypt the data of the current application. This, to a certain extent, prevents cross-application decryption and unauthorized access, and ensures the security and accuracy of business data access.

[0014] In some implementations, the step of decrypting the permission data based on the first quantum key and determining the approval permission of the approval request object in response to the approval request includes: In response to the approval request initiated by the approval request object, obtain the identity credentials of the approval request object and the first set of identifiers; Based on the identity credentials and the first set of identifiers, determine whether the approval request object has the approval authority and the scope of the approval authority.

[0015] In this way, by clearly defining the scope of permissions and strictly limiting the operations and data that the approval request recipient can perform, it can prevent unauthorized behavior such as having only viewing permissions but performing approval actions or having only basic approval permissions but accessing core sensitive data. This blocks security vulnerabilities at the operational level and reduces the risk of information leakage to some extent.

[0016] In some implementations, determining whether the approval request object has the approval authority and the scope of the approval authority based on the identity credential and the first set of identifiers includes: The identity credential is verified based on the identity credential and the first set of identifiers; If the verification passes, the first quantum group key is obtained based on the first set of identifiers; The permission data is decrypted using the first quantum key to determine whether the approval request object has the approval permission and the scope of the approval permission.

[0017] In this way, if the verification fails, the first quantum key cannot be obtained; if the first quantum key is incorrect, the permission data cannot be decrypted. This effectively prevents, to a certain extent, the risk of unauthorized entities obtaining approval permissions or using incorrect first quantum keys to obtain the scope of permissions. Furthermore, by relying on a dedicated first quantum key to decrypt the requested permission data, rather than depending on ambiguous information stored externally, the existence and scope of approval permissions for the requesting entity can be accurately extracted. This avoids, to a certain extent, the errors caused by manual configuration in traditional workflow systems when determining the scope of approval permissions. This ensures, to a certain extent, that the scope of permissions for each approval requesting entity is consistent with the preset rules, thus adapting to the differentiated permission needs of different roles and balancing business flexibility with data security.

[0018] In some implementations, the step of decrypting the business data based on the first quantum process key according to the approval authority of the approval requester, so that the approval requester can approve the application, includes: If it is determined that the object of the approval request has approval authority, the first quantum process key is obtained according to the first workflow identifier; Based on the first quantum process key, the application's business data corresponding to the scope of authority is decrypted, so that the approval request object can approve the application.

[0019] In this way, by precisely mapping the scope of permissions and the scope of decryption, only the minimum range of data necessary for approval is opened to the approval request recipient. This avoids the leakage of sensitive data caused by the decryption of all business data to a certain extent, thereby meeting compliance requirements such as information protection.

[0020] In some embodiments, the method further includes: The business data that has completed the approval process is encrypted and stored based on the first quantum process key; Record execution logs, encrypt the execution logs according to the first quantum process key, and store them.

[0021] In this way, business data and execution logs are always in a high-security encrypted state from application generation and approval process to final storage. This can reduce the risk of data leakage and execution log tampering in the storage or approval process, meet compliance audit requirements, and strengthen the overall storage security of the workflow system.

[0022] In some embodiments, the method further includes: Respond to an audit request initiated by an audit request object, wherein the audit request includes a second workflow identifier to be traced; Obtain the second quantum process key based on the second workflow identifier; The execution log corresponding to the second workflow identifier is decrypted using the second quantum process key, so that the audit request object can audit the audit request.

[0023] In this way, the audit requester verifies the identity credentials of the audited entity and obtains the second quantum process key using the second workflow identifier, thereby enabling the decryption of the execution log of the target application in the audit workflow. This can, to a certain extent, eliminate the risk of audit overreach and ensure that the audit trajectory corresponds one-to-one with the application workflow instance, providing a credible chain of evidence for compliance review.

[0024] The workflow access control system based on quantum encryption mechanism provided in this application includes a front-end service unit, a workflow execution unit, and a cryptographic service platform. The front-end service unit is configured to create an application and send a first acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform according to the application. The secure service platform is configured to generate the first quantum process key and the first quantum group key based on the first acquisition request. The workflow execution unit is configured to send a second acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform. The secure service platform is also configured to send the first quantum process key and the first quantum group key to the workflow execution unit according to the second acquisition request. The workflow execution unit is also configured to encrypt the application's business data according to the first quantum process key; And encrypt the permission data of the application according to the first quantum group key; In response to the approval request for the application, the permission data is decrypted according to the first quantum group key to determine the approval permission of the approval request object; And based on the approval authority of the approval request object, the business data is decrypted using the first quantum process key, so that the approval request object can approve the application.

[0025] Thus, by leveraging the quantum attack-resistant properties of the first quantum process key and the first quantum group key, the encryption protection of workflow data is strengthened from the source, reducing the risk of the first quantum process key and the first quantum group key being cracked or stolen to a certain extent. During the approval stage, the first quantum group key is used to decrypt permission data to verify permissions, constructing a pre-emptive permission protection barrier. This effectively intercepts unauthorized individuals from impersonating the approval request recipient and obtaining information without proper authorization, thus solving the problem of unauthorized individuals impersonating approvers and leaking information to a certain extent. This, in turn, ensures the confidentiality of application information and the overall security of the approval process to a certain degree.

[0026] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0027] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is one of the flowcharts illustrating the workflow permission control method in certain embodiments of this application; Figure 2 This is a second flowchart illustrating the workflow permission control method in some embodiments of this application; Figure 3 This is the third flowchart illustrating the workflow permission control method in some embodiments of this application; Figure 4 This is the fourth flowchart of a workflow permission control method according to certain embodiments of this application; Figure 5 This is the fifth flowchart illustrating the workflow permission control method in some embodiments of this application; Figure 6 This is the sixth flowchart illustrating the workflow permission control method of some embodiments of this application; Figure 7 This is the seventh flowchart illustrating the workflow permission control method in some embodiments of this application; Figure 8 This is the eighth flowchart of a workflow permission control method according to certain embodiments of this application; Figure 9 This is the ninth flowchart of a workflow permission control method according to certain embodiments of this application; Figure 10 This is a flowchart illustrating the workflow for determining approval authority in certain embodiments of this application; Figure 11 This is a timing diagram of the approval process of the workflow permission control method in some embodiments of this application; Figure 12 This is a timing diagram of the audit process of the workflow permission control method in some embodiments of this application. Detailed Implementation

[0028] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0029] With the development of information technology, the demand for enterprise digital transformation, and the concept of process management, workflow systems are widely used in various business scenarios such as internal process automation, government approval, financial reimbursement, and contract processing. These systems typically adopt a centralized service architecture, combining access control mechanisms with traditional encryption methods to ensure system security. However, as enterprises become more digitalized, the data transmitted and stored in workflows is becoming increasingly sensitive, including a large amount of information involving privacy, finance, and compliance. Traditional workflow systems are gradually exposing serious security vulnerabilities.

[0030] For example, in workflow systems using related technologies, the requesting party can typically approve submitted applications at the corresponding approval node. However, vulnerabilities in the system or terminal may allow unauthorized individuals to impersonate approvers and obtain application information, leading to the leakage of such information.

[0031] Furthermore, most workflow systems store business data and execution logs involved in the process execution in plaintext or weakly encrypted form in databases or log systems. Once the database is compromised, attackers can directly obtain all sensitive business information and modify historical approval records, operators, operation times, and other information at the database level. This makes it impossible for the audit process to form a valid chain of evidence and fails to meet the traceability requirements of financial regulators.

[0032] Based on the above issues, please refer to the following: Figure 1 , 11 This application provides a workflow access control method based on a quantum encryption mechanism, the method comprising: 01: In response to the submitted application, obtain the first quantum process key and the first quantum set key; 02: Encrypt the requested business data using the first quantum process key; 03: Encrypt the requested permission data according to the first quantum key; 04: In response to the application approval request, the authorization data is decrypted according to the first quantum key to determine the approval authorization of the approval request object; 05: Based on the approval authority of the approval requester, the business data is decrypted using the first quantum process key so that the approval requester can approve the application.

[0033] Specifically, this application also provides a workflow access control system based on a quantum encryption mechanism, which includes a front-end service unit, a workflow execution unit, and a security service platform.

[0034] The front-end service unit is configured to create an application and send a first acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform based on the application.

[0035] The secret service platform is configured to generate a first quantum process key and a first quantum group key based on a first acquisition request.

[0036] The workflow execution unit is configured to send a second acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform.

[0037] The secure service platform is also configured to distribute the first quantum process key and the first quantum group key to the workflow execution unit based on the second acquisition request.

[0038] The workflow execution unit is also configured to: encrypt the application's business data according to the first quantum process key; encrypt the application's permission data according to the first quantum group key; decrypt the permission data according to the first quantum group key in response to an approval request for the application, determine the approval permission of the approval request object; and decrypt the business data based on the first quantum process key according to the approval permission of the approval request object, so that the approval request object can approve the application.

[0039] The front-end service unit is the interaction entry module between the workflow system and the user. It is responsible for receiving user operations and converting them into application data that the workflow system can recognize, as well as initiating the first acquisition request to obtain the first quantum process key and the first quantum group key.

[0040] The first retrieval request is initiated by the front-end service unit to the security service platform after creating the application, to obtain the first quantum process key and the first quantum group key corresponding to the application. The first retrieval request carries key data such as the application's workflow information and the set of participating objects, so that the security service platform can generate the corresponding first quantum process key and first quantum group key.

[0041] The workflow execution unit is the core business processing module of the workflow system, responsible for critical operations such as data encryption, authorization verification, and approval response. The workflow execution unit relies on the first quantum process key and the first quantum group key issued by the security service platform to complete its work; it does not store these keys itself. This helps to prevent key leakage caused by the first quantum process key and the first quantum group key being stored in business modules.

[0042] The secret service platform is the quantum key generation and management module of the workflow system. It works in conjunction with the quantum key distribution network to generate and store the first quantum process key and the first quantum group key based on the application information, and to issue the first quantum process key and the first quantum group key according to the second acquisition request.

[0043] The second acquisition request is a request initiated by the workflow execution unit to the security service platform to acquire the first quantum process key and the first quantum group key in order to complete data encryption or approval processing.

[0044] The first quantum process key is a quantum-level key generated by the security service platform based on the workflow information of the application and bound to the application. It is used to encrypt and decrypt the business data of the application.

[0045] The first quantum key is a quantum-level key generated by the security service platform based on the set of participating objects and bound to the set of participating objects. It is used to encrypt and decrypt the requested permission data to ensure that the modules corresponding to the members within the set of participating objects can be accessed.

[0046] Business data, which comprises core business information included in the application, serves as the basis for approval decisions and must be protected by encryption using the First Quantum process key. For example, a financial reimbursement application might include information such as the applicant's name, department, reimbursement amount, reason for reimbursement, and attachments.

[0047] The authorization data includes information on approval permissions and must be encrypted and protected using the first quantum key. For example, it specifies which participants can perform approvals and what approval operations they can perform.

[0048] An approval request is an operation request initiated by the approval request object in the workflow to process the application for approval. It is the trigger condition for entering the approval permission verification and data decryption stage.

[0049] The approval request is made to the entity that initiates the approval operation. The approval authority of the entity that initiates the approval operation needs to be determined by the workflow execution unit after decrypting the authority data, which to a certain extent ensures that only legitimate entities can process the application.

[0050] The workflow access control method based on quantum encryption mechanism provided in this application can be applied to workflow access control systems based on quantum encryption mechanism.

[0051] When creating a specific business application in the workflow, the user fills in the application through the front-end service unit, selects a preset process template, and the front-end service unit automatically generates the basic information of the application.

[0052] The front-end service unit sends the first retrieval request to the security service platform based on the basic information of the application.

[0053] After receiving the first acquisition request, the secure service platform generates the first quantum process key and associates and binds it with the workflow instance corresponding to the application.

[0054] After receiving the first acquisition request, the secure service platform generates a first quantum key and associates it with the set of participating entities involved in the application. Members within the set of participating entities can obtain the first quantum key using valid identity credentials, enabling the encryption and decryption of authorized data using the first quantum key.

[0055] When the workflow execution unit needs to process the application data, it sends a second retrieval request to the security service platform.

[0056] After receiving the second acquisition request, the secret service platform distributes the first quantum process key and the first quantum group key to the workflow execution unit through the quantum key distribution network.

[0057] Upon receiving the first quantum process key and the first quantum group key, the workflow execution unit immediately initiates the encryption operation. The first quantum process key is used to encrypt the requested business data, and the first quantum group key is used to encrypt the authorization data.

[0058] When the approval requester initiates an approval request, the workflow execution unit first calls the first quantum key to decrypt the permission data and confirm whether the approval requester is a legitimate approver and what kind of approval permissions they possess.

[0059] After authorization is granted, the first quantum process key is used to decrypt the corresponding business data. After the approval request object completes the approval operation, the workflow execution unit uses the first quantum process key to re-encrypt the business data, including the approval result, to ensure long-term data security.

[0060] Thus, by leveraging the quantum attack-resistant properties of the first quantum process key and the first quantum group key, the encryption protection of workflow data is strengthened from the source, reducing the risk of the first quantum process key and the first quantum group key being cracked or stolen to a certain extent. During the approval stage, the first quantum group key is used to decrypt permission data to verify permissions, constructing a pre-emptive permission protection barrier. This effectively intercepts unauthorized individuals impersonating approvers to obtain information, thus solving the problem of unauthorized individuals impersonating approval request recipients and leaking information to a certain extent. This, in turn, ensures the confidentiality of application information and the overall security of the approval process to a certain degree.

[0061] Please see Figure 11 In some implementations, the first quantum process key is generated based on a first workflow identifier, wherein the first workflow identifier is generated based on the requested workflow information; The first quantum key is generated based on the first set of identifiers, which are generated based on the applicant.

[0062] Specifically, the first workflow identifier can be a string or code used to identify the workflow instance corresponding to a single application. The first workflow identifier is automatically generated by the front-end service unit based on the workflow information of the application and associated with the workflow instance corresponding to the application. It can be used for subsequent first quantum process key query, business data traceability, and permission verification.

[0063] The workflow information in a request is the information included in the request that defines the attributes of the process to which the request belongs. The workflow information in a request includes information such as process type, process template, initiating department, initiation time, and request number, and is the basic data source for generating the first workflow identifier.

[0064] The first set of identifiers can be a string or code used to identify the set of participating objects corresponding to the application. The first set of identifiers is generated by the front-end service unit based on the set of participating objects in the application and associated with the set of participating objects to ensure that members within the set of participating objects can be associated with and obtain the first quantum key.

[0065] The participants in the application are all entities that have a business relationship with the application and need to participate in the execution or approval of the process, including the applicant, the approval request objects at each node, and the process monitors, etc., which is the core data source for generating the first set of identifiers.

[0066] The first quantum process key is generated based on the first workflow identifier. After receiving the first workflow identifier, the security service platform combines the quantum key distribution network to generate the first quantum process key bound to the first workflow identifier. This ensures, to a certain extent, that the business data encryption keys for each workflow instance corresponding to the application exist independently.

[0067] The first quantum key relies on the first set of identifiers for generation. After receiving the first set of identifiers, the cryptographic service platform combines the quantum key distribution network to generate the first quantum key bound to the first set of identifiers, so as to ensure that the participants corresponding to the first set of identifiers can obtain the first quantum key.

[0068] After the front-end service unit creates an application, it extracts the workflow information from the application and generates the first workflow identifier through a preset algorithm. At the same time, the front-end service unit determines the set of participating objects according to the preset rules of the application's process template and generates the first set of identifiers.

[0069] After generating the first workflow identifier and the first set of identifiers, the front-end service unit sends a first acquisition request for the first quantum process key and the first quantum set key to the cryptographic service platform. The first acquisition request carries the first workflow identifier and the first set of identifiers.

[0070] After receiving the first acquisition request, the secure service platform generates a first quantum process key bound to a first workflow identifier and a first quantum group key bound to a first group identifier. Furthermore, the secure service platform stores the first quantum process key and the first quantum group key in association with their corresponding identifiers for subsequent querying and verification.

[0071] The workflow execution unit obtains the first quantum process key from the security service platform through the first workflow identifier to encrypt business data, and at the same time obtains the first quantum group key through the first group identifier to encrypt permission data.

[0072] Understandably, by binding the first workflow identifier with the first quantum process key, one application workflow instance can correspond to one first quantum process key. This can ensure to a certain extent that even if the process key of a certain application is leaked, it can only affect the business data of that application and will not affect other applications. Compared with the traditional template binding key mode, it reduces the scope of security risks to a certain extent and ensures the confidentiality of application information.

[0073] Furthermore, the strong correlation between the first set of identifiers and the set of participants enables the authorization scope of the first quantum key group to be precisely locked to the necessary participants who applied, thereby reducing the risk of irrelevant personnel mistakenly obtaining the key due to the excessive key coverage in traditional workflow execution units to a certain extent.

[0074] In this way, each application workflow instance corresponds to a first quantum process key, and the authorization scope of the first quantum group key is limited according to the participants. This can effectively reduce the risk of batch data leakage under the traditional general key mode, thereby reducing the risk of application information being stolen to a certain extent, and thus ensuring the confidentiality of application information and the overall security of the workflow execution unit to a certain extent.

[0075] Please refer to the following: Figure 2 , 11 In some implementations, step 04 includes: 041: In response to an approval request initiated by the approval requesting object, obtain the identity credentials and first set of identifiers of the approval requesting object; 042: Based on the identity credentials and the first set of identifiers, determine whether the person requesting the approval has the authority to approve.

[0076] Specifically, digital credentials that can be used to prove the true identity of the approval requester are the approval requester's identity credentials, including but not limited to account passwords, dynamic tokens, digital certificates, or biometrics. The approval requester's identity credentials are unique and tamper-proof, and are the core basis for verifying whether the approval requester is legitimate.

[0077] The first set of identifiers, associated with the set of participating entities, can be used to determine whether the requesting entity is a legitimate participant in the application. Only members within the set of participating entities corresponding to the first set of identifiers may have the authority to approve the application.

[0078] The workflow execution unit matches the scope of participants with the identity credentials and the first set of identifiers to determine whether the approval request object meets the preset approval qualifications, that is, whether the approval request object has approval authority.

[0079] When an approval request is initiated by an object, the workflow execution unit responds to the approval request and starts information collection, obtaining the identity credentials of the object and the first set of identifiers corresponding to the approval request. The workflow execution unit verifies the approval permissions of the approval request object based on the collected identity credentials and the first set of identifiers.

[0080] Thus, through dual verification of identity credentials and the first set of identifiers, it prevents identity forgers from gaining permissions through single-role matching and also prevents legitimate individuals from approving cross-applications, effectively blocking the vulnerability of permission abuse from two dimensions. By strongly binding approval permissions to the specific set of participants in an application, compared to traditional global roles, the approval request object can only process applications within its own participating set and cannot access irrelevant application data, further narrowing the scope of security risks and ensuring the confidentiality of application information to a certain extent.

[0081] Please refer to the following: Figure 3 , 11 In some embodiments, step 042 includes: 0421: Verify the identity credential based on the identity credential and the first set of identifiers; 0422: If the verification passes, obtain the first quantum key based on the first set of identifiers; 0423: Decrypt the authorization data using the first quantum key to determine whether the requesting entity has the authorization to grant the authorization.

[0082] Specifically, the workflow execution unit combines the first set of identifiers to verify the association between the identity credentials submitted by the approval request object and the first set of identifiers, queries the identity information of the participating objects corresponding to the first set of identifiers, and determines whether the approval request object belongs to the set of participating objects.

[0083] Passing the verification is a prerequisite for obtaining the first quantum key. Only when the verification is successful can the workflow execution unit start the process of obtaining the first quantum key.

[0084] After the verification is successful, the workflow execution unit uses the first set of identifiers as a unique index to initiate a request to the security service platform to obtain the first quantum key.

[0085] The secure service platform queries the first quantum key bound to the first set of identifiers and distributes it to the workflow execution unit through the quantum key distribution network. This can, to a certain extent, ensure that the acquisition of the first quantum key is strongly bound to the first set of identifiers applied for, thereby effectively avoiding the mis-distribution of the first quantum key.

[0086] The workflow execution unit uses the acquired first quantum key to decrypt the permission data. By parsing the decrypted permission data, the workflow execution unit determines whether the approval request object is on the list of requested approval objects and whether it has the approval operation permission for the current node, thus completing the final permission determination.

[0087] In this way, by linking the legitimacy of identity credentials with the actual content of the authorization data, the vague judgment of only verifying identity without confirming specific authorization is avoided. By decrypting the authorization data, the specific approval authority is clarified, rather than simply determining whether there is eligibility to participate. To a certain extent, it can accurately intercept requests from those who are eligible to participate but do not have the authorization to approve. This can effectively intercept unauthorized access to information by non-approval requesters and, to a certain extent, protect the confidentiality of application information.

[0088] Please refer to the following: Figure 4 , 11 In some implementations, step 05 includes: 051: If it is determined that the object of the approval request has the approval authority, obtain the first quantum process key based on the first workflow identifier; 052: Decrypt all business data of the application based on the first quantum process key, so that the approval request object can approve the application.

[0089] Specifically, the workflow execution unit will only initiate a request to the secure service platform to obtain the first quantum process key if the identified approval request object belongs to the set of participating objects of the application and meets the preset approval qualifications. This can, to a certain extent, prevent unauthorized objects from stealing the first quantum process key and reduce the risk of leakage of the first quantum process key information.

[0090] If it is determined that the object of the approval request has the approval authority, the workflow execution unit initiates a request to the security service platform to obtain the first quantum process key, based on the first workflow identifier.

[0091] After receiving the request, the secure service platform queries the first quantum process key associated with the first workflow identifier and distributes the first quantum process key to the workflow execution unit through the quantum key distribution network. This can ensure the directionality and security of the acquisition of the first quantum process key to a certain extent, thereby reducing the risk of the first quantum process key being acquired incorrectly or stolen.

[0092] The workflow execution unit uses the acquired first quantum process key to decrypt all business data. The decrypted business data can fully present all the information required for approval, thereby ensuring that the approval requester can make an approval decision based on complete data, and at the same time, avoiding approval errors caused by missing data to a certain extent.

[0093] After all business data is decrypted, the workflow execution unit presents the business data to the approval request object in a readable form, enabling the approval request object to view complete information, perform approval or rejection operations, and record the operation results, thus achieving seamless integration between secure decryption and business approval.

[0094] Understandably, by strongly binding the first workflow identifier to the first quantum process key, a single workflow instance for each application corresponds to a unique first quantum process key. This effectively eliminates the risk of mis-issuance of the first quantum process key and cross-application decryption, improving the accuracy and security of data decryption compared to traditional general-purpose key methods. Furthermore, by making approval authorization a prerequisite, the system strictly limits the entities that can obtain the first quantum process key, ensuring that only legitimate approval recipients can initiate decryption operations. This not only prevents unauthorized individuals from stealing the first quantum process key to decrypt data but also avoids security vulnerabilities such as premature decryption without confirmed authorization, thereby ensuring data security and protecting the confidentiality of application information.

[0095] In this way, the subject and scope of business data decryption are strictly limited. Only the legitimate approval requester can obtain the first quantum process key of the application, and the first quantum process key can only decrypt the data of the current application. This, to a certain extent, prevents cross-application decryption and unauthorized access, and ensures the security and accuracy of business data access.

[0096] Please refer to the following: Figure 5 , 11 In some implementations, step 05 further includes: 053: In response to an approval request initiated by the approval requesting object, obtain the identity credentials and first set of identifiers of the approval requesting object; 054: Based on the identity credentials and the first set of identifiers, determine whether the applicant for the approval request has approval authority and the scope of that authority.

[0097] Specifically, the scope of approval authority is based on the business needs of the application and the role positioning of the approval request object, and the preset scope of operation authority and data access that the approval request object can perform.

[0098] Specifically, this can include two categories: first, the scope of operational permissions, such as actions that the approval requester can perform, including viewing, approving, rejecting, and returning for modification; and second, the scope of data access, such as business data that the approval requester can view, including applicant information, application reason, reimbursement amount, and invoice attachments.

[0099] When the first set of identifiers is generated, it is simultaneously bound to the permission scope configuration of each member in the set of participating objects. For example, Manager Zhang is the object of departmental approval requests, with the operation scope of viewing, approving, or rejecting, and the data scope of the applicant, reason, and amount; Director Li is the object of financial approval requests, with the operation scope of viewing, approving, rejecting, or returning, and the data scope of the applicant, reason, amount, and invoice attachments.

[0100] When an approval request is initiated by an object, the workflow execution unit responds to the approval request and starts information collection, obtaining the identity credentials of the object and the first set of identifiers corresponding to the approval request. Based on the collected identity credentials and the first set of identifiers, the workflow execution unit verifies the approval permissions of the approval request object to determine whether the approval request object has approval permissions and the scope of those permissions.

[0101] In this way, by clearly defining the scope of permissions and strictly limiting the operations and data that the approval request recipient can perform, it can prevent unauthorized behavior such as having only viewing permissions but performing approval actions or having only basic approval permissions but accessing core sensitive data. This blocks security vulnerabilities at the operational level and reduces the risk of information leakage to some extent.

[0102] Please refer to the following: Figure 6 , 11 In some implementations, step 054 includes: 0541: Verify the identity credential based on the identity credential and the first set of identifiers; 0542: If the verification passes, obtain the first quantum key based on the first set of identifiers; 0543: Decrypt the permission data based on the first quantum key to determine whether the approval request object has approval authority and the scope of the approval authority.

[0103] Specifically, the workflow execution unit combines the first set of identifiers in the application to perform dual verification of the identity credentials submitted by the approval requester. This verifies both the legitimacy of the identity credentials themselves and the correlation between the identity credentials and the first set of identifiers, and to some extent avoids security vulnerabilities caused by single verification that result in legitimate identities but are irrelevant to the approval process.

[0104] Passing the verification is a prerequisite for obtaining the first quantum key. Only when the verification is successful can the workflow execution unit start the process of obtaining the first quantum key. This, to a certain extent, prevents unauthorized individuals from accessing the first quantum key, thereby reducing the risk of leakage of the first quantum key.

[0105] After successful verification, the workflow execution unit sends a request to the security service platform to obtain the first quantum key, which includes the first set of identifiers.

[0106] The secure service platform uses the first set of identifiers as the query index to retrieve the first quantum key associated with and bound to the first set of identifiers, and distributes it to the workflow execution unit through the quantum key distribution network, thereby ensuring the directionality and security of the acquisition of the first quantum key to a certain extent.

[0107] The workflow execution unit uses the acquired first quantum key to decrypt the permission data. By parsing the decrypted permission data, the workflow execution unit determines whether the approval request object has the approval authority and the specific scope of the approval authority, providing a clear basis for subsequent business data decryption.

[0108] In this way, if the verification fails, the first quantum key cannot be obtained; if the first quantum key is incorrect, the permission data cannot be decrypted. This effectively prevents unauthorized entities from obtaining approval permissions or using incorrect first quantum keys to access the scope of permissions. Furthermore, by relying on a dedicated first quantum key to decrypt the requested permission data, rather than depending on ambiguous information stored externally, the existence and scope of approval permissions for the requesting entity can be accurately extracted. This avoids the errors inherent in manual configuration of approval permission scope determination in traditional workflow systems, ensuring that the permission scope of each approval requesting entity aligns with the preset rules. This adapts to the differentiated permission needs of different roles, balancing business flexibility and data security.

[0109] Please refer to the following: Figure 7 , 11 In some implementations, step 05 further includes: 055: If it is determined that the object of the approval request has the approval authority, obtain the first quantum process key based on the first workflow identifier; 056: Decrypt the application's business data corresponding to the scope of authority based on the first quantum process key, so that the approval request object can approve the application.

[0110] Specifically, based on defined scopes of authority, the minimum amount of business data necessary for an approval request to complete its decision is the business data of the application corresponding to that scope. For example, when a department manager approves an expense reimbursement, their authority is limited to viewing the applicant, the reason for the reimbursement, and the amount. Therefore, the corresponding business data only includes these three types of information, excluding non-essential sensitive data such as the applicant's bank account number and invoice details. Similarly, when a finance director approves an expense reimbursement, their authority is limited to viewing the amount, invoice attachments, and payment method. This approach, to a certain extent, achieves data exposure on demand, reducing the risk of application information leakage.

[0111] If it is determined that the object of the approval request has the approval authority, the workflow execution unit uses the first workflow identifier as the query index to initiate a request to the security service platform to obtain the first quantum process key.

[0112] After receiving the request, the secure service platform retrieves the first quantum process key associated with the first workflow identifier and distributes it to the workflow execution unit through the quantum key distribution network. This can ensure the directionality and security of the acquisition of the first quantum process key to a certain extent, thereby reducing the risk of the first quantum process key being acquired incorrectly or stolen.

[0113] The workflow execution unit uses the acquired first quantum process key to decrypt the business data required within the authorized scope. In this way, during decryption, the data type is matched according to the authorized scope, and only the business data matching the authorized scope is decrypted, while the remaining business data remains encrypted. This ensures, to a certain extent, that non-essential sensitive data is not exposed, thus protecting the confidentiality of the application information.

[0114] In this way, by precisely mapping the scope of permissions and the scope of decryption, only the minimum range of data necessary for approval is opened to the approval request recipient. This avoids the leakage of sensitive data caused by the decryption of all business data to a certain extent, thereby meeting compliance requirements such as information protection.

[0115] Please refer to the following: Figure 8 , 11 In some implementations, the method further includes: 06: Encrypt and store the completed approval data based on the first quantum process key; 07: Record the execution log, encrypt the execution log according to the first quantum process key, and store it.

[0116] Specifically, the business data that has completed the approval process refers to the business data after the approval requester has performed the approval operation, including the approval result and processing traces. For example, in a financial reimbursement application, the business data that has completed the approval process, in addition to the original applicant, amount, and reason, also includes key information such as the approval requester being Manager Zhang, the approval result being "approved," the approval opinion being "reimbursement approved," and the approval time being year-month-day hour:minute:second.

[0117] The execution log is a structured data record of the entire workflow operation trajectory from initiation to approval completion. The content includes the operation subject, operation type, operation time, operation object and operation result in the entire workflow. It is the core basis for audit traceability, fault diagnosis and compliance verification.

[0118] The workflow execution unit uses the same first quantum process key as the decryption business data during the approval process to encrypt the business data including the approval result, and then writes the encrypted business data including the approval result into the persistent storage medium. This ensures that the data in the storage stage and the data in the approval stage use the same high-security key, which can avoid security risks caused by key switching to a certain extent.

[0119] The workflow execution unit encrypts the recorded execution logs using the first quantum process key, then associates them with the corresponding first workflow identifier and stores them. In this way, the encrypted execution logs can only be decrypted by applying for the corresponding first quantum process key, which reduces the risk of tampering with the execution logs to a certain extent and ensures that only authorized entities can view them, thus reducing the risk of information leakage.

[0120] Understandably, approved business data is still encrypted and stored using the first quantum process key to ensure that business data is under quantum-level encryption protection throughout the entire process of generation, approval flow and storage, which can effectively prevent the leakage of sensitive data.

[0121] Furthermore, the execution logs are encrypted using the first quantum process key and associated with the first workflow identifier. On the one hand, encrypting the execution logs can effectively prevent them from being illegally tampered with; on the other hand, the execution logs are strongly associated with the application, and during auditing, they can be accurately decrypted and traced using the first quantum process key, meeting the compliance requirements of financial, government and other scenarios for auditable processes and unalterable trajectories.

[0122] Furthermore, the approval process and storage phase share the same first quantum process key, eliminating the need to generate new quantum process keys. This reduces the complexity of quantum process key management and ensures a consistent security level for quantum process keys, further enhancing the overall security level of the workflow system and providing core technical support for the deployment of the workflow system in high-security scenarios.

[0123] In this way, business data and execution logs are always in a high-security encrypted state from application generation and approval process to final storage. This can reduce the risk of data leakage and execution log tampering in the storage or approval process, meet compliance audit requirements, and strengthen the overall storage security of the workflow system.

[0124] Please refer to the following: Figure 9 , Figure 12 In some implementations, the method further includes: 08: Respond to an audit request initiated by an audit request object, wherein the audit request includes a second workflow identifier to be traced; 09: Obtain the second quantum process key based on the second workflow identifier; 010: Decrypt the execution log corresponding to the second workflow identifier according to the second quantum process key so that the audit request object can audit the audit request.

[0125] Specifically, the audit request can be made to an entity that is qualified to conduct an audit. For example, this could be an internal auditor of a company or a staff member of a regulatory agency.

[0126] The audit requester must obtain audit permissions through identity credentials, and the audit requester's main responsibility is to trace the execution path of the workflow.

[0127] An audit request is an instruction initiated by the audit requesting entity to the workflow system to trace the execution log of a specific workflow. The instruction includes the second workflow identifier to be traced and the identity credentials of the audit requesting entity.

[0128] The second workflow identifier to be traced can be a code corresponding to the workflow instance of the application to be audited, which is used to locate the execution logs of the application's encrypted storage, thereby ensuring to a certain extent that the audit scope does not deviate from the target application.

[0129] The second quantum process key is a quantum-level encryption key associated with and bound to the second workflow identifier, used to decrypt the execution log corresponding to the second workflow identifier.

[0130] An audit request is initiated when the object of the audit request needs to trace the execution path of the application.

[0131] On the one hand, submit your own audit identity credentials for the workflow execution unit to verify audit permissions; on the other hand, explicitly include the second workflow identifier of the application to be traced in the audit request to lock the audit target.

[0132] After receiving the request, the workflow execution unit verifies the validity of the audit identity credentials to determine the audit permissions of the audit request object.

[0133] The workflow execution unit sends a second quantum process key acquisition request to the cryptographic service platform. The acquisition request carries the second workflow identifier.

[0134] The secure service platform uses the second workflow identifier as a unique index to retrieve the second quantum process key bound to the second workflow identifier; and distributes the second quantum process key to the workflow execution unit through the quantum key distribution network to ensure the secure transmission of the second quantum process key.

[0135] After receiving the second quantum process key, the workflow execution unit locates the stored encrypted execution log based on the second workflow identifier and decrypts the execution log content.

[0136] After decryption is complete, the workflow execution unit presents the contents of the execution log to the audit request object.

[0137] It should be noted that the second workflow identifier here is the same as the first workflow identifier in the aforementioned implementation. Similarly, the second quantum process key is the same as the first quantum process key in the aforementioned method. This is only a distinguishing description to differentiate the audit scenarios.

[0138] Understandably, by verifying the identity credentials of the audit object, it can be ensured that the audit request object can only trace the execution log of the target application, which reduces the risk of unauthorized access to business information by the audit to a certain extent, reduces security risks in the audit process, and thus meets the compliance requirements of separating audit logs from business data to a certain extent.

[0139] The execution log is always stored in encrypted form using the quantum process key and can only be decrypted through the audit-specific process. The decryption process is strongly bound to the second workflow identifier. On the one hand, this can prevent the execution log from being illegally tampered with to a certain extent. On the other hand, it can prevent incorrect or missed audits to a certain extent, thereby ensuring that the audit trail corresponds one-to-one with the application instance and providing a credible chain of evidence for compliance review.

[0140] In this way, the audit requester verifies the identity credentials of the audited entity and obtains the second quantum process key using the second workflow identifier, thereby enabling the decryption of the execution log of the target application in the audit workflow. This can, to a certain extent, eliminate the risk of audit overreach and ensure that the audit trajectory corresponds one-to-one with the application workflow instance, providing a credible chain of evidence for compliance review.

[0141] Please see Figure 11 This application also provides a workflow access control system based on quantum encryption mechanism, including a front-end service unit, a workflow execution unit, and a security service platform; The front-end service unit is configured to create an application and send a first acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform based on the application; The secure service platform is configured to generate a first quantum process key and a first quantum group key based on the first acquisition request; The workflow execution unit is configured to send a second acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform; The secure service platform is also configured to distribute the first quantum process key and the first quantum group key to the workflow execution unit based on the second acquisition request; The workflow execution unit is also configured to encrypt the requested business data based on the first quantum process key; And encrypt the requested permission data according to the first quantum key; In response to the application approval request, the authorization data is decrypted according to the first quantum key to determine the approval authorization of the approval request object; And based on the approval authority of the approval requester, the business data is decrypted using the first quantum process key so that the approval requester can approve the application.

[0142] Specifically, users fill out an application through the front-end service unit, select a preset process template, and the front-end service unit automatically generates the basic information for the application.

[0143] The front-end service unit generates a first workflow identifier and a first set of identifiers based on the basic information of the application, and sends a first retrieval request to the security service platform. The first retrieval request carries the first workflow identifier and the first set of identifiers of the application.

[0144] After receiving the first acquisition request, the secret service platform generates and stores the first quantum process key and the first quantum group key.

[0145] When the workflow execution unit needs to process the application data, it sends a second acquisition request to the security service platform. The second acquisition request carries the first workflow identifier and the first set of identifiers.

[0146] The secure service platform distributes the first quantum process key and the first quantum group key to the workflow execution unit through the quantum key distribution network.

[0147] Upon receiving the first quantum process key and the first quantum group key, the workflow execution unit immediately initiates the encryption operation. The first quantum process key is used to encrypt the requested business data, and the first quantum group key is used to encrypt the authorization data.

[0148] When the approval requester initiates an approval request, the workflow execution unit first calls the first quantum key to decrypt the permission data and confirm whether the approval requester is a legitimate approver and what kind of approval permissions they possess.

[0149] After authorization is granted, the first quantum process key is used to decrypt the corresponding business data. After the approval request object completes the approval operation, the workflow execution unit uses the first quantum process key to re-encrypt the business data, including the approval result, to ensure long-term data security.

[0150] Thus, by leveraging the quantum attack-resistant properties of the first quantum process key and the first quantum group key, the encryption protection of workflow data is strengthened from the source, reducing the risk of the first quantum process key and the first quantum group key being cracked or stolen to a certain extent. During the approval stage, the first quantum group key is used to decrypt permission data to verify permissions, constructing a pre-emptive permission protection barrier. This effectively intercepts unauthorized requests from those impersonating approvers to obtain information, thus solving the problem of unauthorized individuals impersonating approvers and leaking information to a certain extent, thereby ensuring the confidentiality of application information and the overall security of the approval process.

[0151] The following is Figure 10 The following example illustrates the workflow for determining approval authority: First, the user submits a node processing request. The workflow for determining approval permissions begins with the user submitting the node processing request, triggering the workflow execution unit to determine whether the user's permissions are valid and whether they can access business data.

[0152] Next, the first layer of verification is performed: the membership check of the participating object set. First, it is determined whether the user is in the participating object set corresponding to the first group of identifiers.

[0153] If the judgment result is negative, it is determined that the user is not in the set of participating objects, access is denied, the workflow is terminated directly, that is, the user does not have the basic access qualifications for this node and cannot perform subsequent operations.

[0154] If the judgment result is yes, then proceed to the first quantum group key acquisition and node permission data decryption stage.

[0155] Subsequently, a second layer of verification is performed, namely obtaining the first quantum key and decrypting the node permission data. When a user belongs to the participating object set, the workflow execution unit obtains the first quantum key from the security service platform and uses it to decrypt the node permission data, thereby obtaining the specific operation permissions that the node grants to users in the current participating object set.

[0156] Then, determine whether the user has node processing permissions.

[0157] If the judgment result is negative, it is determined that the user lacks sufficient permissions, access is denied, and the workflow is terminated. This means that although the user belongs to the set of participants, they do not have specific processing permissions for the current node. For example, a user can only view application information but initiates an approval request.

[0158] If the judgment result is yes, then proceed to the first quantum process key acquisition and business data decryption stage, and use the first quantum process key to decrypt the business data.

[0159] When a user has node processing permissions, the workflow execution unit obtains the first quantum process key from the secure service platform and uses the first quantum process key to decrypt business data, enabling the user to view and perform approval operations based on this data.

[0160] Finally, the approval process and results are encrypted.

[0161] Users execute approval logic based on the decrypted business data. After the operation is completed, the approved business data is encrypted and stored using the first quantum process key, which ensures the security of the approval record to a certain extent and can effectively prevent unauthorized access or tampering.

[0162] Please refer to Figure 11 The following example, a reimbursement process, illustrates the workflow access control method based on quantum encryption mechanism implemented in this application: First, employee Zhang San fills out a travel expense reimbursement application through the front-end service unit of the company's reimbursement system. The reimbursement application includes the travel amount, invoice attachments, and the reason for the trip.

[0163] The front-end service unit generates a first workflow identifier (workflow_id) associated with this expense reimbursement; simultaneously, it generates a first group identifier (group_id) based on the set of participants involved in the reimbursement. For example, the set of participants may include department manager Li Si and financial auditor Wang Wu, among others.

[0164] Subsequently, the front-end service unit sends a first request to the cryptographic service platform to generate the first quantum process key and the first quantum group key.

[0165] The secure service platform generates a first quantum process key bound to the first workflow identifier and a first quantum group key bound to the first group identifier, and stores the first quantum process key and the first quantum group key for later retrieval as needed.

[0166] Secondly, the workflow execution unit sends a second retrieval request to the security service platform.

[0167] The secure service platform distributes the first quantum process key and the first quantum group key to the workflow execution unit through a quantum key distribution network.

[0168] The workflow execution unit then performs encryption operations, encrypting the reimbursement business data with the first quantum process key, encrypting the travel amount and invoices into ciphertext; encrypting the permission data with the first quantum group key, encrypting Li Si's initial review permission rules into ciphertext; and finally storing the data in the workflow system database.

[0169] Then, when department manager Li Si initiates an approval request, the workflow execution unit starts the permission verification and data decryption process.

[0170] The workflow execution unit obtains Li Si's identity credential (employee ID) and the first group identifier (group_id). First, it determines whether Li Si is in the corresponding set of participants. If Li Si is not in the corresponding set of participants, the workflow is terminated. If Li Si is in the set of participants, the workflow execution unit obtains the first quantum key through the secure platform.

[0171] The workflow execution unit decrypts the permission data using the first quantum group key, determines that Li Si belongs to group_id, and that his permission scope is to view travel expenses and reasons, and then performs an approval or rejection operation.

[0172] After the permission verification is successful, the workflow execution unit requests the first quantum process key, carrying the first workflow identifier (workflow_id), from the secure service platform. Upon obtaining the first quantum process key, the workflow execution unit only decrypts business data within Li Si's authorized scope, including travel expenses and the reason for the trip (business trip to Beijing), and displays it to Li Si for approval.

[0173] Finally, after Li Si clicks "approval," the workflow execution unit uses the first quantum process key to re-encrypt the business data containing the amount, the approval request recipient Li Si, and the approval result, to ensure the security of long-term data storage.

[0174] Simultaneously, an execution log is recorded, including the operator, time, and result, and stored encrypted using the first quantum process key. If auditors subsequently need to trace the reimbursement process, they initiate an audit request and include the second workflow identifier (workflow_id). The security service platform obtains the second quantum process key based on the second workflow identifier (workflow_id) and decrypts the execution log using it for auditors to view, thus ensuring the traceability of the audit trail. It should be noted that the second workflow identifier here is the same as the first workflow identifier mentioned above, and similarly, the second quantum process key is the same as the first quantum process key mentioned above; this is merely a distinguishing description to differentiate the audit scenario.

[0175] Through the above process, the layered quantum encryption design of the first quantum group key control authority and the first quantum process key control business data, combined with the module collaboration and strong binding of identification and keys of the front-end service unit, the cryptographic service platform and the workflow execution unit, to a certain extent achieves the effect of only authorized users being able to approve, full quantum encryption of business data throughout the process and full-link auditability, meeting the high security requirements of scenarios such as enterprise reimbursement.

[0176] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0177] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of executable request code comprising one or more steps for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0178] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A workflow access control method based on quantum encryption mechanism, characterized in that, The method includes: In response to the submitted application, a first quantum process key and a first quantum group key are obtained, wherein the first quantum process key is generated based on a first workflow identifier, the first workflow identifier is generated based on the workflow information of the application, and the first quantum group key is generated based on a first group identifier, the first group identifier is generated based on the participants of the application; The application's business data is encrypted using the first quantum process key; The requested permission data is encrypted using the first quantum group key; In response to the approval request for the application, the permission data is decrypted according to the first quantum group key to determine the approval permission of the approval request object; Based on the approval authority of the approval request object, the business data is decrypted using the first quantum process key, so that the approval request object can approve the application.

2. The workflow access control method according to claim 1, characterized in that, The step of responding to an approval request for the application by decrypting the permission data according to the first quantum key and determining the approval permission of the approval request object includes: In response to the approval request initiated by the approval request object, obtain the identity credentials of the approval request object and the first set of identifiers; Based on the identity credentials and the first set of identifiers, determine whether the approval request object has the approval authority.

3. The workflow access control method according to claim 2, characterized in that, The step of determining whether the approval request object has the approval authority based on the identity certificate and the first set of identifiers includes: The identity credential is verified based on the identity credential and the first set of identifiers; If the verification passes, the first quantum group key is obtained based on the first set of identifiers; The permission data is decrypted using the first quantum key to determine whether the approval request object has the approval permission.

4. The workflow access control method according to claim 2, characterized in that, The step of decrypting the business data based on the first quantum process key according to the approval authority of the approval requester, so that the approval requester can approve the application, includes: If it is determined that the object of the approval request has approval authority, the first quantum process key is obtained according to the first workflow identifier; All business data of the application is decrypted based on the first quantum process key, so that the approval request object can approve the application.

5. The workflow access control method according to claim 1, characterized in that, The step of responding to an approval request for the application by decrypting the permission data according to the first quantum key and determining the approval permission of the approval request object includes: In response to the approval request initiated by the approval request object, obtain the identity credentials of the approval request object and the first set of identifiers; Based on the identity credentials and the first set of identifiers, determine whether the approval request object has the approval authority and the scope of the approval authority.

6. The workflow access control method according to claim 5, characterized in that, The step of determining whether the approval request object has the approval authority and the scope of the approval authority based on the identity credential and the first set of identifiers includes: The identity credential is verified based on the identity credential and the first set of identifiers; If the verification passes, the first quantum group key is obtained based on the first set of identifiers; The permission data is decrypted using the first quantum key to determine whether the approval request object has the approval permission and the scope of the approval permission.

7. The workflow access control method according to claim 5, characterized in that, The step of decrypting the business data based on the first quantum process key according to the approval authority of the approval requester, so that the approval requester can approve the application, includes: If it is determined that the object of the approval request has approval authority, the first quantum process key is obtained according to the first workflow identifier; Based on the first quantum process key, the application's business data corresponding to the scope of authority is decrypted, so that the approval request object can approve the application.

8. The workflow access control method according to any one of claims 4-7, characterized in that, The method includes: The business data that has completed the approval process is encrypted and stored based on the first quantum process key; Record execution logs, encrypt the execution logs according to the first quantum process key, and store them.

9. The workflow access control method according to claim 8, characterized in that, The method includes: Respond to an audit request initiated by an audit request object, wherein the audit request includes a second workflow identifier to be traced; Obtain the second quantum process key based on the second workflow identifier; The execution log corresponding to the second workflow identifier is decrypted using the second quantum process key, so that the audit request object can audit the audit request.

10. A workflow access control system based on quantum encryption mechanism, characterized in that, This includes the front-end service unit, workflow execution unit, and secure service platform; The front-end service unit is configured to create an application and send a first acquisition request for a first quantum process key and a first quantum group key to the security service platform according to the application, wherein the first quantum process key is generated based on a first workflow identifier, the first workflow identifier is generated based on the workflow information of the application, the first quantum group key is generated based on a first group identifier, and the first group identifier is generated based on the participating objects of the application; The secure service platform is configured to generate the first quantum process key and the first quantum group key based on the first acquisition request. The workflow execution unit is configured to send a second acquisition request for the first quantum process key and the first quantum group key to the cryptographic service platform. The secure service platform is also configured to send the first quantum process key and the first quantum group key to the workflow execution unit according to the second acquisition request. The workflow execution unit is also configured to encrypt the application's business data according to the first quantum process key; And encrypt the permission data of the application according to the first quantum group key; In response to the approval request for the application, the permission data is decrypted according to the first quantum group key to determine the approval permission of the approval request object; And based on the approval authority of the approval request object, the business data is decrypted using the first quantum process key, so that the approval request object can approve the application.

Images