A verifiable access control system for multi-organization collaborative invoice registration links

Abstract

This invention discloses a verifiable access control system for a multi-organization collaborative invoice registration chain. Addressing the problem that existing invoice registration chains only record the registration and flow of a single invoice, failing to express the pre-processing relationships of multiple related invoices and the access verification order across multiple organizations within the chain, resulting in cross-organization access control relying on external log splicing, a complex process, and unrepeatable operation, this invention introduces a related invoice processing chain structure based on the main structure of the invoice registration chain. It also designs an in-chain business-level access verification comprehensive calculation mechanism and an in-chain business-level access verification judgment and in-chain write-back mechanism. Within the chain, it calculates the related invoice processing chain, business processing stages, and participation requirements, and writes the access judgment conclusions and basis, achieving independent in-chain calculation, verifiable sequence, and auditable reproducibility for cross-organization access control.

Description

Technical Field

[0001] This invention relates to the field of cross-organizational access control and link-level structured representation technology, and more specifically, to a multi-organizational collaborative invoice registration link verifiable access control system. Background Technology

[0002] Cross-organizational access control and link-level structured representation technologies are used in multi-participant business scenarios to uniformly map processing records, access verification behaviors, and business dependencies scattered across various organizations' local systems into a link structure. This enables access decisions to be completed independently based on records within the link, and possesses repeatable and verifiable characteristics. Existing multi-organizational collaborative invoice registration link systems can typically record the registration and transfer information of a single invoice within the link, ensuring the authenticity and tamper-proof nature of the registration data, and providing an in-link data source for invoice verification, comparison, and basic access decisions. Some systems further structure invoice status, business nodes, and processing entities by extending registration fields or combining with local permission systems to enhance business processing and collaborative management capabilities.

[0003] The existing technology has the following shortcomings:

[0004] Existing technologies suffer from an unavoidable structural limitation in multi-organizational collaborative invoice processing. The invoice registration chain uses a single invoice as the sole record object, reflecting only the processing status of that invoice at each registration node. It lacks the ability to express the pre-dependencies of multiple related invoices and does not record multi-organizational access verification behaviors and their sequential structure. Actual business processing often consists of multiple related invoices processed sequentially. Whether an invoice is allowed access depends not only on whether its preceding invoices have been processed according to rules but also on whether the relevant organizations have completed access verification at the corresponding stage. Therefore, if the system relies solely on the registration chain of a single invoice for access judgment, it will inevitably miss the preceding invoices and access verification status related to the business, resulting in insufficient precision in cross-organizational access control. Attempting to add these business-level preconditions relies on each organization's local permission configuration, internal approval processes, and access audit logs, manually piecing together scattered external records into an access execution chain. However, external log formats are inconsistent, and they cannot be shared across organizations, making it difficult to form reproducible and verifiable internal evidence. To address these problems, this invention proposes a solution. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a verifiable access control system for multi-organization collaborative invoice registration links to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A verifiable access control system for multi-organization collaborative invoice registration links, comprising:

[0008] The relevant invoice processing chain management module is used to identify and maintain the relevant invoice processing chain set based on the main structure of the invoice registration chain, providing a unified business-level object foundation for subsequent business processing stage division and in-chain access verification.

[0009] The Business Processing Stage Anchor Point and Participation Requirement Registration Module is used to divide the business processing stage based on the relevant invoice processing chain set and register the corresponding participation requirements, generating a business processing stage sequence set and a business processing stage participation requirement field set.

[0010] The multi-organization access verification result record management module is used to generate and maintain a multi-organization access verification result record set within the main structure of the invoice registration link.

[0011] The business-level access verification comprehensive calculation module is used to execute the intra-chain business-level access verification comprehensive calculation mechanism within the main structure of the invoice registration chain. It performs business-level participation requirement determination on cross-organization access requests in the order of relevant invoice processing chain positioning, business processing stage determination, stage access verification statistical set generation, and business-level participation requirement comprehensive judgment, and generates stage access verification statistical set and business-level access verification comprehensive calculation result set.

[0012] The access verification and write-back module is used to execute the intra-chain business-level access verification and write-back mechanism within the main structure of the invoice registration link. It generates an intra-chain access verification result set and a write-back record set for cross-organization access requests, and writes the write-back record set into the main structure of the invoice registration link.

[0013] In a preferred embodiment, the related invoice processing chain management module has an invoice registration chain main structure corresponding to the invoice registration chain structure formed by the existing invoice registration system, which is used to store the invoice registration record set. The invoice registration record set records multiple invoice registration records on a single invoice basis. Each invoice registration record carries the registration information of the invoice at a certain registration node on a predetermined registration chain, so that the registration status of a single invoice at different registration nodes can be sequentially represented within the chain. The related invoice processing chain set is used to organize multiple related invoices on a business-wide basis.

[0014] In a preferred embodiment, in the business processing stage anchor point and participation requirement registration module, the business processing stage sequence set is used to describe the overall structure of the business processing stages within each relevant invoice processing chain, so as to obtain the sequential relationship and business meaning of each business processing stage within the chain; the business processing stage participation requirement field set is used to express the participation constraints of each business processing stage in terms of access verification, so as to give the computable conditions for the number of participating organizations and role coverage within the chain.

[0015] In a preferred embodiment, the multi-organization access verification result record management module includes a multi-organization access verification result record set for recording multi-organization access verification results occurring within the relevant invoice processing chain.

[0016] In a preferred embodiment, the in-chain business-level access verification comprehensive calculation mechanism takes the access request input set as input and the stage access verification statistics set and the business-level access verification comprehensive calculation result set as output. Within the main structure of the invoice registration link, it sequentially completes the positioning of the relevant invoice processing chain, the determination of the business processing stage, the generation of the stage access verification statistics set, and the comprehensive determination of the business-level participation requirements, thus forming the in-chain business-level access verification comprehensive calculation path.

[0017] In a preferred embodiment, the access request input set is used to record the input information of cross-organizational access requests; the stage access verification statistics set is used to record the in-chain statistics of each business processing stage in terms of access verification; and the business-level access verification comprehensive calculation result set is used to record the comprehensive judgment result of business-level access verification and the stage result reference information.

[0018] In a preferred embodiment, in the in-chain business-level access verification comprehensive calculation mechanism, the relevant invoice processing chain positioning is used to locate the corresponding relevant invoice processing chain range within the relevant invoice processing chain set based on the access request input set; the business processing stage determination is used to determine the business processing stage to which the access request belongs within the relevant invoice processing chain range based on the business processing stage sequence set; the stage access verification statistics set generation is used to statistically analyze and determine the number of participating organizations, organizational role coverage, and invoice coverage of each business processing stage within the business processing stage based on the business processing stage participation requirement field set and the multi-organization access verification result record set, thereby obtaining the stage access verification statistics set; and the business-level participation requirement comprehensive determination is used to combine and judge the stage access verification statistics set on a unit basis (relevant invoice processing chain) to obtain the business-level access verification comprehensive calculation result set.

[0019] In a preferred embodiment, the in-chain business-level access verification and in-chain write-back mechanism reads the comprehensive calculation result set of business-level access verification and the preset judgment rule configuration when each cross-organization access request arrives, generates a final judgment conclusion on whether access is allowed, writes the conclusion into the in-chain access verification judgment result set for external use, generates a judgment write-back record set, and writes a reference field pointing to the in-chain access verification judgment result set in the corresponding business processing stage of the invoice registration link main structure, so that the calculation result of business-level access verification is converted into a callable judgment result at the execution layer and fixed in the invoice registration link main structure.

[0020] In a preferred embodiment, the in-chain access verification result set is used to record the in-chain access verification judgment conclusion according to the access request dimension, and the judgment write-back record set is used to record the write-back information of access verification judgment according to the relevant invoice processing chain and business processing stage dimension.

[0021] In a preferred embodiment, the preset judgment rule configuration is used to provide access verification judgment strategies for different business processing stages and different organizational roles, including requiring a strict judgment mode in high-risk or critical business scenarios, adopting a lenient judgment mode in low-risk or differentiated control scenarios, and the acceptable range of insufficient stages and the constraints that must be strictly met in the lenient judgment mode.

[0022] This invention provides a verification access control system for multi-organization collaborative invoice registration links, highlighting its effectiveness and advantages.

[0023] This invention introduces a relevant invoice processing chain structure into the invoice registration link, and combines an in-chain business-level access verification comprehensive calculation mechanism and an in-chain business-level access verification judgment and in-chain write-back mechanism. This transforms the cross-organizational access verification process from inference from scattered logs outside the chain to a unified structured expression and calculation process within the chain, eliminating the dependence on concatenating logs outside the chain. Within the main structure of the invoice registration link, it simultaneously realizes in-chain indexing, sequence verifiability, and access path reconstruction, enabling the access judgment process to be completed independently within the chain and to be auditable and reproducible. This effectively improves the accuracy, reliability, and consistency of cross-organizational access control. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the system structure of the present invention;

[0025] Figure 2 This is a schematic diagram of the integrated computation mechanism for in-chain business-level access verification of the present invention;

[0026] Figure 3 This is a schematic diagram of the in-chain business-level access verification and in-chain write-back mechanism of the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] This invention provides a verifiable access control system for multi-organizational collaborative invoice registration links, addressing the core contradiction that existing invoice registration link structures cannot meet the business-level cross-organizational access control requirements in multi-organizational collaborative invoice processing scenarios. Existing invoice registration links can only record the registration flow of a single invoice, lacking the ability to express the pre-processing relationships between multiple related invoices under the same business, nor recording the access verification behaviors and their sequence structure generated by participating organizations during access and approval processes. Therefore, if the system relies solely on the registration link of a single invoice for judgment, it will miss the processing and access verification of business-level pre-invoices, resulting in significantly insufficient precision in cross-organizational access control. If the system attempts to add business-level pre-conditions, it must rely on the local permission configurations, internal approval processes, and access audit logs of each organization, manually piecing together records scattered outside the link into an execution link for a single access. However, the inconsistent format of external logs and their inability to be shared across organizations make the access verification process complex, error-prone, and unreproducible within the link.

[0029] To resolve the contradiction between the lack of in-chain structure and the unavailability of out-of-chain information, this invention proposes a system capable of reconstructing the overall business processing flow within the chain and supporting verifiable access control. By introducing a related invoice processing chain structure on top of the main invoice registration chain structure, the sequential relationship of multiple related invoices under the same business is presented uniformly in a structured manner within the chain. Based on this, this invention proposes an in-chain business-level access verification comprehensive calculation mechanism. Through in-chain parsing of related invoice processing chains, business processing stages, and participation requirements, it generates the calculation results of the preconditions required for access requests. Furthermore, it proposes an in-chain business-level access verification judgment and in-chain write-back mechanism, writing the access judgment conclusion and key evidence into the chain structure, enabling cross-organizational access judgments to be completed independently within the chain, possessing sequential verifiability and recalculation.

[0030] Based on the above design concept, this invention constructs a multi-organizational collaborative invoice registration link verifiable access control system consisting of five modules. These modules sequentially complete the management of relevant invoice processing chains, registration of anchor points and participation requirements at business processing stages, management of multi-organizational access verification records, comprehensive calculation of business-level access verification, and access verification judgment and in-chain write-back. This transforms cross-organizational access verification from inference from scattered logs outside the chain into a unified structured expression and calculation process within the chain. (Refer to...) Figure 1 , Figure 1 This is a schematic diagram of the system structure of the present invention, which includes:

[0031] The related invoice processing chain management module 101 is used to identify and maintain the related invoice processing chain set C101 based on the main structure L101 of the invoice registration chain. The main structure L101 corresponds to the invoice registration chain structure formed by the existing invoice registration system and is used to store the invoice registration record set. The invoice registration record set records multiple invoice registration records per invoice. Each invoice registration record carries the registration information of that invoice at a specific registration node on a given registration chain, allowing the registration status of a single invoice at different registration nodes to be sequentially represented within the chain. The related invoice processing chain set C101 is used to organize multiple related invoices on a business-wide basis. Through module 101, the system can manage invoice registration data within L101 in units of related invoice processing chains, providing a unified business-level object foundation for subsequent business processing stage division and in-chain access verification.

[0032] The business processing stage anchor point and participation requirement registration module 102 is used to divide the business processing stages based on C101 and register the corresponding participation requirements, generating a business processing stage sequence set S102 and a business processing stage participation requirement field set A102. This enables the system to organize and constrain the multi-organization access verification process within the main structure L101 of the invoice registration chain, based on business processing stages. Specifically, S102 describes the overall structure of the business processing stages within each relevant invoice processing chain, allowing the system to obtain the sequential relationships and business meanings of each business processing stage within the chain; A102 expresses the participation constraints of each business processing stage in terms of access verification, enabling the system to provide calculable conditions for the number of participating organizations and role coverage within the chain.

[0033] The multi-organization access verification result record management module 103, based on L101, C101, and S102, aggregates access verification behaviors scattered in the local permission systems and access audit logs of various organizations into a chain-structured result record, generating and maintaining the multi-organization access verification result record set R103. R103 is used to record multi-organization access verification results occurring within the relevant invoice processing chain.

[0034] The business-level access verification comprehensive calculation module 104 is used to execute the in-chain business-level access verification comprehensive calculation mechanism M104, and to determine the participation requirements of cross-organizational access requests within the business level. M104 receives the access request input set I104, and based on C101, S102, A102, and R103 within the invoice registration link main structure L101, it constructs a stage access verification statistics set T104 within L101 and generates a business-level access verification comprehensive calculation result set U104. This allows the system to complete recalculated business-level access verification calculations without relying on external permission systems or local access audit logs. Specifically, I104 records the input information of cross-organizational access requests; T104 records the in-chain statistics for access verification at each business processing stage; and U104 records the business-level access verification comprehensive judgment results and stage result reference information.

[0035] The access verification and write-back module 105 executes the intra-chain business-level access verification and write-back mechanism M105 based on U104 and T104. It provides access verification for cross-organizational access requests and completes the intra-chain write-back, forming an intra-chain access verification result set O105 and a write-back record set W105 within the L101 chain. This allows the system to record directly callable and traceable access verification results only within the main L101 chain of the invoice registration link, fixing these results in L101 according to the relevant invoice processing chain and business processing stage. Specifically, the intra-chain access verification result set O105 records the intra-chain access verification conclusion according to the access request dimension, and the write-back record set W105 records the write-back information of the access verification judgment according to the relevant invoice processing chain and business processing stage dimension.

[0036] In summary, this invention constructs an intra-chain recalculated access verification mechanism chain around the main structure L101 of the invoice registration link. This mechanism chain uses C101 as the business-level object layer, S102 and A102 as stage anchor layers, R103 as the access verification result aggregation layer, T104 and U104 as the business-level comprehensive calculation layer, and O105 and W105 as the judgment result fixing layer. This enables the system to simultaneously possess intra-chain indexing capabilities, sequential verifiability capabilities, and access path reconstruction capabilities within L101. Therefore, without relying on external permission systems and access audit logs, the recalculation and judgment of business-level access verification can be completed solely through intra-chain records.

[0037] The following detailed description, in conjunction with specific embodiments, illustrates the specific implementation of the system of the present invention within a typical operating cycle. It should be understood that these embodiments are merely illustrative of the technical solutions of the present invention and are not intended to limit it. Without altering the essence of the invention, the relevant steps, parameters, and module divisions can be appropriately adjusted.

[0038] In an optional embodiment, the related invoice processing chain management module 101 is used to identify and maintain related invoice processing chain sets based on the main structure of the invoice registration chain, providing a unified business-level object foundation for subsequent business processing stage division and in-chain access verification. This module organizes multiple related invoices on a business-wide basis without changing the meaning of existing invoice registration fields, enabling the invoice registration chain to express the related invoice processing chain hierarchy while maintaining its existing registration functions.

[0039] In the above embodiment, the system first reads field information reflecting the invoice business processing relationship from the invoice registration record set in the main structure L101 of the invoice registration link, and identifies the invoice set with related relationships within the same business scope according to preset business processing rules. The business processing rules are used to define the starting invoice identification method in the business processing process, as well as the related relationships and order relationships corresponding to voiding, red-ink reversal, and reissue invoice relationships, which can cover scenarios such as cross-period red-ink reversal and cross-period settlement. For each set of related invoices, the system determines the sequential position of each invoice in the business processing process according to the business processing order specified by the business processing rules, forming a corresponding invoice number set and sequence field set, which serves as the business-level structured expression of the set of related invoices. The system abstracts each set of related invoices with obtained invoice number set and sequence field set into a related invoice processing chain, generates a unique processing chain number for the related invoice processing chain, and records the processing chain number, invoice number set, and sequence field in the related invoice processing chain set C101. At the same time, the system adds a processing chain number field to each invoice registration record in the main structure L101 of the invoice registration link, marking invoice registration records belonging to the same related invoice processing chain with the same processing chain number. This enables the system to aggregate and retrieve invoice registration records according to the processing chain number in the main structure L101 of the invoice registration link, and to match the processing chain number with the records in the related invoice processing chain set C101 one by one.

[0040] In an optional embodiment, the business processing stage anchor point and participation requirement registration module 102, based on the invoice registration link main structure L101, enables the system to express the business processing stage and its participation requirements within the chain by dividing the business processing stage, setting the business processing stage anchor point, and registering the business processing stage participation requirements. This provides a clear source of stage-level constraints for subsequent multi-organization access verification.

[0041] In the above embodiment, the system first reads the relevant invoice processing chain set C101, and according to the preset business processing stage division rules, divides the business processing process corresponding to each relevant invoice processing chain into several business processing stages. A unique stage number is assigned to each business processing stage, and the stage type and its sequential position in the relevant invoice processing chain are recorded, forming a business processing stage sequence set S102. The business processing stage division rules are used to define the stage and sequential relationship of business events such as invoice issuance, receipt, declaration, deduction, red-ink cancellation, and reissue of invoices in the relevant invoice processing chain, and can be configured and expanded according to actual business needs. The business processing stage sequence set S102 is used to describe the overall structure of the business processing stages within each relevant invoice processing chain, so as to obtain the sequential relationship and business meaning of each business processing stage within the chain.

[0042] After the business processing stage sequence set S102 is established, the business processing stage anchor point and participation requirement registration module 102 determines the coverage of the registration records corresponding to the business processing stage anchor point in the invoice registration link main structure L101 for each business processing stage according to the preset business processing stage anchor point setting rules. Module 102 selects invoice registration records belonging to the same related invoice processing chain and the same business processing stage from the invoice registration record set based on the processing chain number field and the stage number field. These invoice registration records are marked as the in-chain coverage segment of the business processing stage in the invoice registration link main structure L101, and the processing chain number field, stage number field, stage type field, and stage order field are written into the corresponding segment, so that the system can accurately locate the registration record segment corresponding to the business processing stage within the chain by combining the processing chain number and the stage number.

[0043] The system reads the participation requirements for each business processing stage from the preset business processing stage participation requirement configuration, generates a business processing stage participation requirement field group record, and writes it to the business processing stage participation requirement field group set A102. The business processing stage participation requirement field group set A102 is used to express the participation constraints of each business processing stage in terms of access verification, so as to provide computable conditions for the number of participating organizations and role coverage within the chain. Module 102 registers at least the processing chain number field, stage number field, required participating role set field, minimum participating organization number field, and cross-organization participation requirement field in A102, and writes a reference field pointing to A102 in the registration record section corresponding to the business processing stage, so that each business processing stage corresponds to a unique business processing stage participation requirement field group within the chain.

[0044] In an optional embodiment, the multi-organization access verification result record management module 103 is used to form an access verification result record structure with relevant invoice processing chains and business processing stages as coordinates within the main structure L101 of the invoice registration link, generate and maintain a multi-organization access verification result record set R103, and provide a complete and recalcible source of in-chain evidence for access verification in subsequent stages.

[0045] In the above embodiments, the system pre-configures access verification record collection rules and access verification record maintenance rules. The access verification record collection rules define how access verification behaviors, under the constraints of the relevant invoice processing chain set C101 and the business processing stage sequence set S102, complete the business scope and business processing stage attribution. The access verification record maintenance rules define the value range of the verification status field and the identification methods for duplicate and revoked records. Module 103 receives access verification behavior records from each organization's local permission system and access audit logs. It parses the access organization number, organization role number, verification time, verification status, and access request information related to business processing from the records. Based on the access verification record collection rules, it determines the corresponding processing chain number in the relevant invoice processing chain set C101 and the corresponding business processing stage number in the business processing stage sequence set S102, ensuring that each access verification behavior has a unique processing chain number field and stage number field within the chain.

[0046] During implementation, the system records each single access verification action at a specific granularity. It writes the processing chain number, stage number, invoice number, accessing organization number, organization role number, verification time, and verification status fields into the multi-organization access verification result record set R103, forming a multi-organization access verification result record structure with the relevant invoice processing chain number and business processing stage number as coordinates. Module 103 reserves duplicate record marker and revocation marker fields in the multi-organization access verification result record set R103. Based on the access verification record maintenance rules, without deleting the original records, it sorts records within the same processing chain number and stage number range by verification time, identifies duplicate and revoked records, and records the duplicate and revocation relationships in the corresponding marker fields. This ensures that the multi-organization access verification result record set R103 simultaneously retains complete original records and a valid set of records usable for calculation. Module 103 organizes the records in the multi-organization access verification result record set R103 according to the combination of the processing chain number field and the stage number field, so that all multi-organization access verification result records under the same business processing stage within the same related invoice processing chain form a record set that can be directly retrieved and reconstructed.

[0047] After the multi-organization access verification result record set R103 is established and maintained, the multi-organization access verification result record management module 103 writes an access verification result reference field for each business processing stage in the corresponding registration record segment of the business processing stage in the invoice registration link main structure L101. This associates the business processing stage, identified by both the processing chain number field and the stage number field, with the corresponding record set in the multi-organization access verification result record set R103. The multi-organization access verification result record set R103 is used to record multi-organization access verification results occurring within the relevant invoice processing chain. The access verification result reference field provides an in-chain reference entry for the access verification result for each business processing stage within the invoice registration link main structure L101.

[0048] In an optional embodiment, the business-level access verification comprehensive calculation module 104 is used to execute the intra-chain business-level access verification comprehensive calculation mechanism M104 within the invoice registration link main structure L101. This mechanism is used to complete the intra-chain comprehensive calculation of cross-organizational access verification within the invoice registration link main structure L101, enabling the system to complete the business-level access verification comprehensive calculation solely through intra-chain records without relying on external permission systems and local access audit logs. The system then provides the access verification judgment and intra-chain write-back module 105 with directly referable intra-chain calculation results.

[0049] In the above embodiment, M104 takes the access request input set I104 and the related invoice processing chain set C101 as inputs, and the business processing stage sequence set S102, the business processing stage participation requirement field set A102, and the multi-organization access verification result record set R103 in the main structure L101 of the invoice registration link as the intra-chain data inputs. It outputs the stage access verification statistics set T104 and the business-level access verification comprehensive calculation result set U104, sequentially completing the relevant invoice processing chain location, business processing stage determination, stage access verification statistics set generation, and business-level participation requirement comprehensive judgment, thus forming a complete intra-chain business-level access verification comprehensive calculation path. (Refer to...) Figure 2 , Figure 2 This is a schematic diagram of the integrated computation mechanism for in-chain business-level access verification of the present invention.

[0050] First, in the relevant invoice processing chain location, M104 reads the access request input set I104 and parses the access source information, access organization information, access role information, and target invoice information for each cross-organization access request record. The target invoice information serves as the basis for locating the business scope in the relevant invoice processing chain set C101. Based on the target invoice's affiliation in the relevant invoice processing chain set C101, M104 determines the relevant invoice processing chain to which the target invoice belongs, obtaining a processing chain number for subsequent calculations to limit the processing chain scope for this business-level access verification comprehensive calculation. If the same invoice number is registered in multiple processing chain number ranges, M104 compares candidate processing chains according to pre-configured business scope determination rules, combining the business context field recorded in the access request input set I104 and the invoice set recorded in the relevant invoice processing chain set C101, selecting the processing chain number that matches the business meaning of this access request.

[0051] Then, in the business processing stage determination, M104 reads the business processing stage sequence set S102 after determining the processing chain number. Based on the stage order information of the processing chain number in the business processing stage sequence set S102 and the invoice registration record time information covered by the corresponding business processing stage anchor point in the invoice registration link main structure L101, combined with the access time information and business context field recorded in the access request input set I104, it locates the business processing stage number to which the current access request belongs and uses this business processing stage as the target stage for this business-level access verification comprehensive calculation. At the same time, M104 selects the preceding key business processing stages that need to be included in the judgment from other business processing stages within the same processing chain range as the target stage, according to the business rules. The target business processing stage number and the preceding key business processing stage number are combined to form a stage set, which is used to limit the scope of business processing stages involved in this business-level access verification comprehensive calculation.

[0052] Next, in the generation of the phased access verification statistics set, after obtaining the processing chain scope and phase set, M104 reads the participation requirement records under the corresponding processing chain number and business processing phase number combination from the business processing phase participation requirement field set A102, obtaining the organizational participation quantity requirements, organizational role coverage requirements, and cross-organizational participation requirements for each business processing phase. Using the combination of processing chain number and business processing phase number as coordinates, M104 extracts the access verification result records already registered within the processing chain scope and each business processing phase scope from the multi-organization access verification result record set R103, using these records as the intra-chain data basis for subsequent phased access verification statistics and business-level access verification comprehensive calculations. For each business processing stage in the stage set, M104, based on the corresponding record set, counts the number of organizational entities participating in access verification within that business processing stage, the types of organizational roles actually appearing within that business processing stage, and the number of invoices covered by access verification within that business processing stage. Based on the organizational participation quantity requirements, organizational role coverage requirements, and cross-organizational participation requirements recorded in the business processing stage participation requirement field set A102, M104 determines whether the business processing stage meets the constraints in terms of participation requirements. M104 uniformly registers the statistical results and satisfaction determination results of that business processing stage into a single stage access verification statistical record, and writes it into the stage access verification statistics set T104 according to a combination of the processing chain number and the business processing stage number, ensuring that each business processing stage included in the calculation corresponds to a unique stage statistical record within the chain.

[0053] Finally, in the comprehensive determination of business-level participation requirements, after completing the statistics and determination of each business processing stage within the stage set, M104 combines the stage-level participation requirement satisfaction results by processing chain number. When all business processing stages within the stage set meet their respective participation requirements, M104 determines that the processing chain meets the business-level participation requirements within the business level corresponding to this access request; when any business processing stage within the stage set does not meet the participation requirements, M104 determines that the processing chain does not meet the business-level participation requirements within the business level. Based on this, M104 generates a business-level calculation result record in the business-level access verification comprehensive calculation result set U104, registering information such as the processing chain number, the target business processing stage number corresponding to this access request, the determination result of whether the business-level participation requirements are met, and the stage result list into the database, and optionally recording the explanation of the reasons for non-compliance, which is used to indicate the specific business processing stage that caused the business-level determination to be unsatisfied and its corresponding statistical deficiencies, so that the access verification determination and in-chain write-back module 105 can directly read and interpret the business-level access verification comprehensive calculation results within the chain.

[0054] To facilitate implementation and parameter tuning, without altering the above steps and decision logic, this module provides the following supplementary explanation regarding the quantification path for the staged access verification statistics set and business-level comprehensive decision. The system processes chain numbers... With business processing stage number Under the combined coordinates, records in the multi-organization access verification result record set R103 are filtered, and on this basis, a set of phased access verification statistics and business-level participation requirement judgment marks are constructed.

[0055] At any given processing chain number and business processing stage number The system first filters access verification result records in the multi-organization access verification result record set R103 that belong to the scope of the processing chain and the scope of the business processing stage and whose verification status field value is "passed", forming a valid access verification record set: ;in, This represents an access verification result record in R103. This indicates the processing chain number field in the record. This indicates the business processing stage number field in the record. This indicates the verification status field in the record, and its value is limited to: and Only when the value is At that time, the record is included in the set of valid access verification records. .

[0056] The system verifies the set of valid access records. Based on this, and following established deduplication and aggregate statistics rules, the number of organizational participants, the required role coverage, and the number of covered invoices within this business processing stage are calculated. The corresponding statistics are denoted as follows: , and .in, Used to indicate the chain number being processed. and business processing stage number The number of different organizational entities that actually participated in access verification during the corresponding business processing phase; This indicates the extent to which the actual organizational roles appearing during this business processing phase cover the set of required participating roles registered in the business processing phase participation requirement field set A102. When the actual set of organizational roles covers all required participating roles... The value is 1, when only some of the required roles are covered. The value is less than one; when the required participating role set field is not registered in A102 for a certain business processing stage, the system will, at the implementation level, A value of 1 indicates that no mandatory coverage constraint is imposed on the role dimension during this business processing phase. This is used to indicate the number of invoices covered by the access verification record within this business processing stage, reflecting the invoice coverage within the relevant invoice processing chain for this business processing stage. The above statistics are used as statistical fields in the stage access verification statistics set T104 in this module, organized using the combination of the processing chain number and the business processing stage number as the primary key. The specific calculation can be implemented using conventional deduplication counting and set statistics algorithms in the art; this invention does not limit the specific implementation algorithm.

[0057] To characterize the cross-organizational participation features at the organizational level during the business processing phase, the system determines, based on the set of valid access verification records, whether the number of different organizational entities participating in access verification during that business processing phase is not less than two, and constructs a cross-organizational participation marker accordingly. When the number of different organizational entities participating in the access verification is not less than two, A value of 1 indicates that this business processing stage has cross-organizational participation characteristics; when the number of different organizational entities participating in access verification is less than two... A value of 0 indicates that this business processing stage does not have cross-organizational participation characteristics. The constraints on cross-organizational participation in this business processing stage are given by the cross-organizational participation requirement field of the corresponding record in the business processing stage participation requirement field set A102, denoted as... Its value is 0 or 1. When the value is 1, it means that the business processing stage requires cross-organizational participation. When the value is 0, it means that the business processing stage does not impose mandatory requirements on cross-organizational participation.

[0058] The system calculates the stage-level participation requirement satisfaction flag based on the statistics of the number of participating organizations, the statistics of the required role coverage, the cross-organizational participation flag, and the minimum number of participating organizations registered in the business processing stage participation requirement field set A102. The minimum number of participating organizations is denoted as... , used to indicate the chain number in processing and business processing stage number The minimum number of participating organizations required to complete access verification within the corresponding business processing phase, and its value is a positive integer not less than one. The phase-level participation requirement fulfillment flag is defined as follows: When the number of participating organizations is not less than the minimum number of participating organizations parameter, the required role coverage is equal to one, and the cross-organizational participation flag is not less than the cross-organizational participation requirement, the system will mark the stage-level participation requirement satisfaction. Setting it to 1 indicates that the business processing stage meets the participation requirements overall under the three constraints of number of organizations, role coverage, and cross-organizational participation; when any of the above conditions are not met, the system will set the stage-level participation requirement satisfaction flag to 0.

[0059] After the stage-level participation requirement satisfaction mark calculation is completed, the system processes the chain number. Within the corresponding business scope, for the set of stages The stage-level participation requirement satisfaction tags of all business processing stages are combined to form a business-level basic comprehensive satisfaction tag. Stage set The business-level basic comprehensive satisfaction mark is determined by the stage sequence structure under the processing chain number in the business processing stage sequence set S102 and the configuration of the preceding key business processing stages in the business rules. Since the stage-level participation requirement satisfaction flag can only take the value 0 or 1, the business-level basic comprehensive satisfaction flag... It also only takes the value 0 or 1. (When the stage set...) When the stage-level participation requirement satisfaction flag is 1 for all business processing stages, A value of 1 indicates that the participation requirements are met across the entire business scope corresponding to this access request; when the stage set When the memory's stage-level participation requirement satisfaction flag is 0 in any business processing phase, A value of 0 indicates that at least one business processing stage has a gap in participation requirements at the business level. The system will then mark the stage-level participation requirement fulfillment status. The write phase access verification statistics set T104 will mark the overall satisfaction of the business-level infrastructure. Write the business-level participation requirement judgment field into the business-level access verification comprehensive calculation result set U104, so that the business-level access verification comprehensive calculation process forms a complete in-chain calculation closed loop within the invoice registration link main structure L101, from access verification result recording to stage statistical results and then to business-level comprehensive judgment results.

[0060] Through the aforementioned quantitative supplementary path, the in-chain business-level access verification comprehensive calculation mechanism M104 completes the quantitative generation of the stage access verification statistics set T104 and the business-level access verification comprehensive calculation result set U104 within the main structure L101 of the invoice registration link, providing a directly referable in-chain quantitative basis for subsequent access verification judgment and in-chain write-back process.

[0061] In an optional embodiment, the access verification judgment and in-chain write-back module 105 is used to execute the in-chain business-level access verification judgment and in-chain write-back mechanism M105 based on the business-level access verification comprehensive calculation result set U104 and the stage access verification statistics set T104, to provide access verification judgment for cross-organization access requests and complete the in-chain write-back. When each cross-organization access request arrives, M105 reads the in-chain calculation result and the preset judgment rule configuration, generates the final judgment conclusion on whether access is allowed, writes the conclusion into the in-chain access verification judgment result set O105 for external calling, and generates a judgment write-back record set W105. A reference field pointing to W105 is written into the anchor section of the corresponding business processing stage in the invoice registration link main structure L101, so that the calculation result of business-level access verification is converted into a callable judgment result at the execution layer and fixed in the chain.

[0062] In the above embodiment, M105 takes the business-level access verification comprehensive calculation result set U104 and the stage access verification statistics set T104 as inputs, and under the constraints of the preset judgment rule configuration, takes the in-chain access verification judgment result set O105 and the judgment write-back record set W105 as outputs. It sequentially completes three parts of processing: access verification judgment generation, judgment mode and tolerable gap control, and in-chain write-back record generation and anchor point attachment. It is used to convert the business-level calculation results generated by the business-level access verification comprehensive calculation module 104 and the stage statistics results in the stage access verification statistics set T104 into access verification judgment records that can be directly called, and writes the judgment results back to the invoice registration link main structure L101 chain according to the relevant invoice processing chain and business processing stage number, thereby forming a complete in-chain access verification judgment and mode control path.

[0063] First, in the access verification judgment generation section, M105 is triggered after the business-level access verification comprehensive calculation module 104 completes its calculation. It then provides a final access judgment for each cross-organization access request and completes the in-chain write-back. M105 first locates the corresponding record in the business-level access verification comprehensive calculation result set U104 based on the access request identifier, reads the relevant invoice processing chain scope, target business processing stage, stage result list, and explanation of reasons for non-compliance, and uses this information as the in-chain input basis for this judgment. (Refer to...) Figure 3 , Figure 3 This is a schematic diagram of the in-chain business-level access verification and in-chain write-back mechanism of the present invention.

[0064] Then, in the judgment mode and tolerable gap control section, M105 obtains the business risk level, judgment mode type, and tolerable gap parameters that match the current business scenario according to the preset judgment rules configuration. The preset judgment rule configuration is used to provide access verification judgment strategies for different business processing stages and different organizational roles, including requiring a strict judgment mode in high-risk or critical business scenarios, adopting a lenient judgment mode in low-risk or differentiated control scenarios, and defining the acceptable range of stage deficiencies and the constraints that must be strictly met under the lenient judgment mode; the tolerable gap parameter is used to limit the maximum statistical deficiency range of allowed stage participation requirements under the lenient judgment mode. Based on this, M105 determines the judgment mode type that should be adopted for this access request and clarifies the applicable boundaries of this judgment in terms of tolerable gaps. For business scenarios configured with a strict judgment mode, M105 directly judges whether to allow access based on the business-level comprehensive conclusion and the explanation of non-compliance in the business-level access verification comprehensive calculation result set U104. When the in-chain calculation results show that the relevant business processing stage as a whole meets the participation requirements, an access-allowed conclusion is given; when any non-compliance exists, an access-denied conclusion is given. For business scenarios configured with a lenient judgment mode, M105 identifies deficiencies in the current calculation from the business-level access verification comprehensive calculation result set U104. Combining the corresponding stage statistics and stage-level judgment results recorded in the stage access verification statistics set T104, it compares each of these deficiencies with the tolerable gap parameter. Stage deficiencies that meet the tolerable range are considered to be accepted by the rules, while stage gaps that exceed the tolerable range are considered unacceptable. Based on the comparison results, it gives a comprehensive conclusion of allowing or denying access.

[0065] Finally, in the in-chain write-back record generation and anchor point connection section, after obtaining the final access judgment conclusion and the judgment mode type adopted, M105 writes a judgment record into the in-chain access verification judgment result set O105 at the access request level. The in-chain access verification judgment result set O105 includes at least an access request identifier field, a judgment result value field, a judgment mode type field, and a description reference field. The judgment result value field records the final allow or deny conclusion of this access request within the chain; the judgment mode type field records whether a strict or lenient judgment mode was used; and the description reference field records reference information pointing to the business-level access verification comprehensive calculation result set U104 and, if necessary, the stage access verification statistics set T104, facilitating external callers and auditors to trace the in-chain basis of this judgment when needed. After writing to O105, M105 generates the write-back record for the judgment write-back record set W105. M105 uses the relevant invoice processing chain number and business processing stage number as coordinates to create a write-back record for each completed access request. This record records the final judgment result within the business scope and stage, the judgment mode type used, and the identifier of the corresponding business-level access verification comprehensive calculation result in U104. The judgment write-back record set W105 is used to convert the judgment conclusion at the access request dimension into index information for the relevant invoice processing chain and business processing stage within the chain, enabling subsequent reconstruction of the access verification judgment process according to the link structure within the chain. After the write-back record is generated, M105 writes a reference field pointing to the judgment write-back record set W105 in the business processing stage anchor point segment associated with the corresponding relevant invoice processing chain number and business processing stage number in the main structure L101 of the invoice registration link. During this process, M105 adds a judgment write-back reference field to the extended field group to which the business processing stage anchor point belongs, setting the value of this field to the identifier of the corresponding write-back record in the judgment write-back record set W105. Without altering the meaning of the existing registration fields in the main structure L101 of the invoice registration chain, each business processing stage is thus associated with a corresponding access verification and decision write-back record. This allows auditors and regulators to reconstruct the complete business-level access verification calculation and decision process by relying solely on the main structure L101 of the invoice registration chain and its attached C101, S102, A102, R103, T104, U104, O105, and W105, following the relevant invoice processing chain and the sequence of business processing stages.

[0066] Without altering the aforementioned steps and decision logic, this module supplements the quantitative implementation of in-chain access verification decision-making as follows for ease of implementation and parameter tuning. Based on the business-level access verification comprehensive calculation result set U104 and the stage access verification statistics set T104, M105 introduces a decision mode marker. Business-level basic comprehensive satisfaction mark 1. Relaxed judgment mark and final judgment mark It is used to express the in-chain access verification conclusions under different judgment modes in a unified form.

[0067] in, This is a decision mode marker used to indicate the processing chain number. The current judgment mode type used for the business request is determined by the judgment mode configuration parameter in the preset judgment rule configuration, and its value is 0 or 1; when When it indicates that a strict judgment mode is adopted, when This indicates that a lenient judgment mode is being used. This is a business-level basic comprehensive satisfaction marker used to indicate the processing chain number. Whether the business request comprehensively meets the business-level participation requirements within the scope of the target business processing stage and its preceding key business processing stages is calculated and given by the business-level access verification comprehensive calculation module 104 in the business-level access verification comprehensive calculation result set U104, with a value of 0 or 1, and is given only if all business processing stages included in the calculation fully meet the participation requirements. If any stage of the business process fails to meet the participation requirements .

[0068] This is a lenient decision marker, used to indicate whether, under lenient decision mode, the processing chain numbered [number] can be [number] within the preset tolerable gap parameter constraint range. The business requests are considered as a whole to meet the requirements. The value is calculated by the access verification judgment and in-chain write-back module 105 in a lenient judgment mode based on the stage access verification statistics set T104, the business-level access verification comprehensive calculation result set U104, and the tolerable gap parameter in the preset judgment rule configuration, and takes the value of 0 or 1; when all the deficiencies recorded in the business-level access verification comprehensive calculation result set U104 are judged to be within the tolerable gap range with the support of the statistical information of the stage access verification statistics set T104, When any deficiency exceeds the tolerance gap rule's allowable range, This invention is not... The specific calculation algorithm is limited, only the data source and the meaning of the values ​​are agreed upon.

[0069] This is the final decision marker, used to indicate the processing chain number. The final conclusion of the business request after in-chain access verification and judgment takes a value of 0 or 1, determined by... , and The joint decision-making relationship is defined as follows: Based on the above definition, under the strict decision-making model, if and only if hour, This indicates that the chain grants permission to access; in the lenient decision mode, when... but hour, This indicates that access is permitted within the limits allowed by the tolerable gap rule; otherwise... This indicates that access is not allowed under the current judgment mode. M105 will... The values ​​are mapped to the judgment result value field in the in-chain access verification judgment result set O105, and... The value is written to the judgment mode type field in the in-chain access verification judgment result set O105, and the record is recorded by referring to the description field. and The corresponding business-level access verification comprehensive calculation result set U104 and the stage access verification statistics set T104 record identifiers are registered in the judgment write-back record set W105. At the same time, the relevant processing chain number and business processing stage number are registered in the judgment write-back record set W105 and referenced through the business processing stage anchor section in the invoice registration link main structure L101, so that the above-mentioned quantitative markers can realize traceable judgment expression within the chain.

[0070] Through the above operation process, without relying on the local plaintext logs of each organization, this system solidifies cross-organizational access verification behavior in the invoice registration link in the form of indexable, traceable, and recalculated records, thereby realizing link-level verifiable access control in multi-organization collaborative invoice processing scenarios.

[0071] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0072] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0073] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and inventive constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0074] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0075] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0076] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A verifiable access control system for multi-organization collaborative invoice registration links, characterized in that, include: The relevant invoice processing chain management module is used to identify and maintain the relevant invoice processing chain set based on the main structure of the invoice registration chain, providing a unified business-level object foundation for subsequent business processing stage division and in-chain access verification. The Business Processing Stage Anchor Point and Participation Requirement Registration Module is used to divide the business processing stage based on the relevant invoice processing chain set and register the corresponding participation requirements, generating a business processing stage sequence set and a business processing stage participation requirement field set. The multi-organization access verification result record management module is used to generate and maintain a multi-organization access verification result record set within the main structure of the invoice registration link. The business-level access verification comprehensive calculation module is used to execute the intra-chain business-level access verification comprehensive calculation mechanism within the main structure of the invoice registration chain. It performs business-level participation requirement determination on cross-organization access requests in the order of relevant invoice processing chain positioning, business processing stage determination, stage access verification statistical set generation, and business-level participation requirement comprehensive judgment, and generates stage access verification statistical set and business-level access verification comprehensive calculation result set. The access verification and write-back module is used to execute the intra-chain business-level access verification and write-back mechanism within the main structure of the invoice registration link. It generates an intra-chain access verification result set and a write-back record set for cross-organization access requests, and writes the write-back record set into the main structure of the invoice registration link.

2. The multi-organization collaborative invoice registration link verifiable access control system according to claim 1, characterized in that, In the related invoice processing chain management module, the main structure of the invoice registration chain corresponds to the invoice registration chain structure formed by the existing invoice registration system, and is used to store the invoice registration record set. The invoice registration record set records multiple invoice registration records on a single invoice basis. Each invoice registration record carries the registration information of the invoice at a certain registration node on a predetermined registration chain, so that the registration status of a single invoice at different registration nodes can be sequentially represented within the chain. The related invoice processing chain set is used to organize multiple related invoices on a business-wide basis.

3. The multi-organization collaborative invoice registration link verifiable access control system according to claim 1, characterized in that, In the business processing stage anchor point and participation requirement registration module, the business processing stage sequence set is used to describe the overall structure of the business processing stages within each relevant invoice processing chain, so as to obtain the sequential relationship and business meaning of each business processing stage within the chain; the business processing stage participation requirement field set is used to express the participation constraints of each business processing stage in terms of access verification, so as to give the computable conditions for the number of participating organizations and role coverage within the chain.

4. The multi-organization collaborative invoice registration link verifiable access control system according to claim 1, characterized in that, In the multi-organization access verification result record management module, the multi-organization access verification result record set is used to record multi-organization access verification results that occur within the relevant invoice processing chain.

5. The multi-organization collaborative invoice registration link verifiable access control system according to claim 1, characterized in that, The in-chain business-level access verification comprehensive calculation mechanism takes the access request input set as input and the stage access verification statistics set and the business-level access verification comprehensive calculation result set as output. Within the main structure of the invoice registration link, it sequentially completes the positioning of the relevant invoice processing chain, the determination of the business processing stage, the generation of the stage access verification statistics set, and the comprehensive judgment of the business-level participation requirements, thus forming the in-chain business-level access verification comprehensive calculation path.

6. The multi-organization collaborative invoice registration link verifiable access control system according to claim 5, characterized in that, The access request input set is used to record the input information of cross-organization access requests; the stage access verification statistics set is used to record the in-chain statistics of access verification in each business processing stage; The business-level access verification comprehensive calculation result set is used to record the comprehensive judgment result of business-level access verification and the reference information of the stage result.

7. A verifiable access control system for multi-organization collaborative invoice registration links according to claim 5, characterized in that, In the aforementioned in-chain business-level access verification comprehensive calculation mechanism, the relevant invoice processing chain positioning is used to locate the corresponding relevant invoice processing chain range within the relevant invoice processing chain set based on the access request input set; the business processing stage determination is used to determine the business processing stage to which the access request belongs within the relevant invoice processing chain range based on the business processing stage sequence set; and the stage access verification statistics set generation is used to statistically analyze and determine the number of participating organizations, organizational role coverage, and invoice coverage in each business processing stage based on the business processing stage participation requirement field set and the multi-organization access verification result record set, thereby obtaining the stage access verification statistics set. The business-level participation requirement comprehensive judgment is used to combine and judge the set of stage access verification statistics on the relevant invoice processing chain to obtain the business-level access verification comprehensive calculation result set.

8. The multi-organization collaborative invoice registration link verifiable access control system according to claim 1, characterized in that, The in-chain business-level access verification and write-back mechanism reads the comprehensive calculation result set of business-level access verification and the preset judgment rule configuration when each cross-organization access request arrives, generates a final judgment conclusion on whether access is allowed, writes the conclusion into the in-chain access verification judgment result set for external use, generates a judgment write-back record set, and writes a reference field to the in-chain access verification judgment result set in the corresponding business processing stage of the invoice registration link main structure, so that the calculation result of business-level access verification is converted into a callable judgment result at the execution layer and fixed in the invoice registration link main structure.

9. A verifiable access control system for multi-organization collaborative invoice registration links according to claim 8, characterized in that, The in-chain access verification result set is used to record the in-chain access verification judgment conclusion according to the access request dimension, and the judgment write-back record set is used to record the write-back information of access verification judgment according to the relevant invoice processing chain and business processing stage dimension.

10. A verifiable access control system for multi-organization collaborative invoice registration links according to claim 8, characterized in that, The preset judgment rule configuration is used to provide access verification judgment strategies for different business processing stages and different organizational roles, including requiring a strict judgment mode in high-risk or critical business scenarios, adopting a lenient judgment mode in low-risk or differentiated control scenarios, and the acceptable range of insufficient stages and the constraints that must be strictly met in the lenient judgment mode.

Images