CN111414591A

CN111414591A - Workflow management method and device

Info

Publication number: CN111414591A
Application number: CN202010135732.7A
Authority: CN
Inventors: 黄坤; 冯晓峰; 唐啸; 张勇辉; 杨帆; 杨志军; 董亮
Original assignee: China Construction Bank Corp; CCB Finetech Co Ltd
Current assignee: China Construction Bank Corp
Priority date: 2020-03-02
Filing date: 2020-03-02
Publication date: 2020-07-14
Anticipated expiration: 2040-03-02
Also published as: CN111414591B

Abstract

The invention discloses a method and a device for workflow management, and relates to the technical field of computers. One embodiment of the method comprises: constructing a user authority service table of a service system in a service data table space; constructing a user permission adaptation table of a cross-table space; and constructing a user authority workflow view of the workflow system in a workflow data table space according to the user authority service table and the user authority adaptation table. According to the embodiment, the workflow data table space is constructed, and hierarchical, differential and independent management is performed on the workflow data table space, so that the relevance between the business process and the business data can be decoupled, and the read-write permission and the safety of the data are enhanced; the user identity authorities of the business system and the workflow system are uniformly managed by constructing the user authority view, the non-perception and real-time data mapping and synchronization to the workflow execution logic are realized quickly and efficiently, and the usability, expandability, modular assembly capability and commercial implementation convenience of the workflow are greatly improved.

Description

Workflow management method and device

Technical Field

The invention relates to the technical field of computers, in particular to a method and a device for workflow management.

Background

Activti is a Business Process Management (BPM) framework released by Alfresco software at 17.5.2010, and is an open-source, flexible and easily extensible executable process language framework covering the fields of business process management, workflow, service collaboration and the like. When the Activiti component is adopted for workflow management, the Activiti component provides a set of user right management module, and a service system using the Activiti component also has a user right management module, so that user right management and maintenance are required to be analyzed in the Activiti component and the service system respectively.

In the process of implementing the invention, the inventor finds that at least the following problems exist in the prior art:

(1) the correlation degree between the business process and the business data is high;

(2) the synchronization of multiple user identity authorities needs to be maintained simultaneously, the problem of inconsistent reading and writing is easy to occur, the cost is high, and the usability is low.

Disclosure of Invention

In view of this, embodiments of the present invention provide a method and an apparatus for workflow management, which can decouple the association between a service flow and service data, enhance the read-write right and security of sensitive data of a workflow, implement unified management on user identity rights of a service system and a workflow system, quickly and efficiently implement non-perceptual real-time data mapping and synchronization to a workflow execution logic, and greatly improve the usability, expandability, modular componentization capability, and convenience of large-scale commercial implementation of a workflow.

To achieve the above object, according to an aspect of an embodiment of the present invention, there is provided a method of workflow management, including:

constructing a user authority service table of a service system in a service data table space;

constructing a user permission adaptation table of a cross-table space;

and constructing a user authority workflow view of the workflow system in a workflow data table space according to the user authority service table and the user authority adaptation table so that the workflow system executes a workflow according to the user authority workflow view.

Optionally, after constructing the user right service table of the service system in the service data table space, the method further includes: and updating the user authority service table.

Optionally, the workflow system executes the workflow according to the user permission workflow view, including:

creating a workflow in response to a workflow initiation request, the workflow including at least one approval role; determining an approval user of each approval role in the workflow according to the user permission workflow view; if the approval role is the last approval role in the workflow, entering the next approval role after the approval user finishes the approval task of the approval role; otherwise, ending the workflow.

Optionally, the user authority service table includes: a service user table, a service group table, a service user and group relation table; the user permission workflow view comprises: a workflow user view, a workflow group view, a workflow user and group relationship view.

Optionally, the user permission adaptation table includes at least one of: workflow role whitelist, workflow role blacklist, time constraints for workflow execution.

According to a second aspect of the embodiments of the present invention, there is provided an apparatus for workflow management, including:

the service system user authority management module is used for constructing a user authority service table of the service system in the service data table space;

the user permission adaptation module is used for constructing a user permission adaptation table of a cross-table space;

the workflow system user authority management module is used for constructing a user authority workflow view of the workflow system in a workflow data table space according to the user authority service table and the user authority adaptation table;

and the workflow system execution module executes the workflow according to the user permission workflow view.

Optionally, the service system user right management module is further configured to: and after a user authority service table of the service system is constructed in the service data table space, updating the user authority service table.

Optionally, the workflow system execution module executes the workflow according to the user permission workflow view, including:

According to a third aspect of embodiments of the present invention, there is provided an electronic device for workflow management, comprising:

one or more processors;

a storage device for storing one or more programs,

when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method provided by the first aspect of the embodiments of the present invention.

According to a fourth aspect of embodiments of the present invention, there is provided a computer readable medium, on which a computer program is stored, which when executed by a processor, implements the method provided by the first aspect of embodiments of the present invention.

One embodiment of the above invention has the following advantages or benefits: by constructing a special workflow data table space and carrying out hierarchical, differential and independent management on the special workflow data table space and the business data table space, the relevance of a business process and business data can be decoupled, and the read-write permission and the safety of workflow sensitive data are enhanced; by constructing a cross-table-space user authority view, unified management of user identity authorities of a business system and a workflow system is achieved, perceptive and real-time data mapping and synchronization to workflow execution logic are achieved rapidly and efficiently, and usability, expandability, modularization capability of assembly and convenience of large-scale commercial implementation of the workflow are improved greatly.

Further effects of the above-mentioned non-conventional alternatives will be described below in connection with specific embodiments.

Drawings

The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:

FIG. 1 is a schematic illustration of the main flow of a method of workflow management of an embodiment of the present invention;

FIG. 2 is a schematic diagram of the main modules of an apparatus for workflow management of an embodiment of the present invention;

FIG. 3 is a schematic diagram of the main blocks of a means of workflow management in an alternative embodiment of the invention;

FIG. 4 is a schematic flow chart of the operation of the means for workflow management in an alternative embodiment of the present invention;

FIG. 5 is an exemplary system architecture diagram in which embodiments of the present invention may be employed;

fig. 6 is a schematic block diagram of a computer system suitable for use with a terminal device or server implementing an embodiment of the invention.

Detailed Description

Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, in which various details of embodiments of the invention are included to assist understanding, and which are to be considered exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

According to an aspect of an embodiment of the present invention, a method of workflow management is provided.

Fig. 1 is a schematic diagram of a main flow of a workflow management method according to an embodiment of the present invention, and as shown in fig. 1, the workflow management method includes: step S101, step S102, and step S103.

Step S101, a user authority service table of the service system is constructed in the service data table space.

The tablespace belongs to a storage structure in a database, is a logical space for storing database objects (such as data files), is the largest logical unit of information storage in the database, and further comprises logical data types such as segments, areas, data blocks and the like. The tablespace is a space opened in the database and used for storing objects of the database, one database can be composed of a plurality of tablespaces, and the performance of the database can be optimized through the tablespace.

The service data table space is used for storing service data, and the workflow data table space is used for storing workflow data. The business data table space and the workflow data table space may be located in different databases or may be located in the same database. In the embodiment of the invention, the business data table space and the workflow data table space are stored in the same database.

The user authority service table stores each user and authority information thereof in the service system. Optionally, the user authority service table includes: a service user table, a service group table, a service user and group relation table. The service user table is used for storing each user in the service system. The service group table is used for storing each group in the service system, and each group corresponds to one approval role in the workflow. The service user and group relation table is used for storing the corresponding relation between each user in the service user table and each group in the service group table.

Optionally, after constructing the user right service table of the service system in the service data table space, the method further includes: and updating the user authority service table. For example, adding, deleting, modifying and the like are performed on the constructed user authority service table. The user authority service table of the embodiment of the invention has expandability.

And S102, constructing a user authority adaptation table crossing the table space.

The business data table space and the workflow data table space are two different table spaces. The user authority adaptation table maps the user authority service table to a workflow data table space to construct a user authority workflow view of the workflow system, so that the user authority adaptation table is a data adaptation table of a cross-table space.

The user right adaptation table is used for filtering the information in the user right service table, and the content in the user right adaptation table is the specific filtering condition. The filtering condition can be selectively set according to the actual situation, and the constructed user authority adaptation table can be updated through operations such as adding, deleting, modifying and the like, so that the expandability is realized. Optionally, the user permission adaptation table includes at least one of: workflow role whitelist, workflow role blacklist, time constraints for workflow execution. The workflow role white list is used for recording users authorized to play a certain role, the workflow role black list is used for recording users not authorized to play a certain role, and the time constraint of workflow execution is used for recording the execution time limit of the workflow, for example, the execution time is 9:00-18:00 per day.

Step S103, according to the user authority service table and the user authority adaptation table, a user authority workflow view of the workflow system is built in a workflow data table space, so that the workflow system executes a workflow according to the user authority workflow view.

A view is a virtual table whose contents are defined by a query, like a real table, a view contains a series of columns and row data with names, however, a view does not exist in the database as a set of stored data values.

The user permission workflow view is used for determining each user in the workflow and permission information thereof. Optionally, the user authority service table includes: a service user table, a service group table, a service user and group relation table; the user permission workflow view comprises: a workflow user view, a workflow group view, a workflow user and group relationship view. The workflow user view is used to determine individual users in the workflow. The workflow group view is used for determining various groups in the workflow, and each group corresponds to one approval role in the workflow. The workflow user and group relationship view is used to determine a correspondence between each user in the workflow user view and each group in the workflow group view.

According to the invention, by constructing a dedicated workflow data table space and carrying out hierarchical, differentiated and independent management with the service data table space, the correlation between a service flow and service data can be decoupled, and the read-write permission and the safety of workflow sensitive data are enhanced; by constructing a cross-table space user authority view, only one user authority data is stored in a business system and a workflow system, so that the unified management of the user identity authority of the business system and the user identity authority of the workflow system is realized, any real-time modification of the user authority data of the business system can be synchronized and refreshed in real time in the view of the workflow system indiscriminately, the imperceptible and real-time data mapping and synchronization to workflow execution logic are realized quickly and efficiently, and the usability, expandability, modularization capability of assembly and convenience of large-scale commercial implementation of the workflow are greatly improved.

Optionally, the workflow system executes the workflow according to the user permission workflow view, including: creating a workflow in response to a workflow initiation request, the workflow including at least one approval role; determining an approval user of each approval role in the workflow according to the user permission workflow view; if the approval role is the last approval role in the workflow, entering the next approval role after the approval user completes the approval task of the approval role; otherwise, ending the workflow.

Illustratively, there are five service groups in the service system, and the corresponding five roles are: the process initiator, the process initial review post, the process review post, the department leader and the legal approval. The related roles of a certain business approval workflow are only three, namely a process initiator, a process initial review post and a process re-check post, and the department leader and legal approval in a business system are unrelated to the process. There are three users with roles as flow initiators, which are: role _ start _ user1, role _ sta _ user2, role _ start _ user 3. The users with the roles of the process initial review post have three roles, which are respectively: role _ verify _ user1, role _ verify _ user2, role _ verify _ user 3. The users with the roles of the process review post have three roles, which are respectively: role _ resume _ user1, role _ resume _ us er2, role _ resume _ user 3. The role _ recheck _ user3 of the process review post role cannot undertake the examination and approval work (illness, leave, work out, etc.) in the initial review process due to uncontrollable factors. The step of executing the workflow according to the user permission workflow view comprises the following steps:

(1) a user role _ starter _ user1 with the role as a flow initiator initiates a flow and submits a task; this task is defined as task _ user 1. At which time the phase of task _ user1 changes from the issue phase to the commit phase. At the time of initiating a process submission task, the role _ startup _ user1 may specify that the next role to process the current task is process review. In engineering implementation, the specification may be specified in workflow design, or may be specified in a variable transfer and function call manner. In any case, it is determined that the processing role of the next stage of review is the process initial review.

(2) The user role _ verify _ user1 with the role of initial process review logs in the workflow system and then refers to the task to be handled, and can refer to the task _ user 1. The query idea is as follows: querying the user role in the workflow user and group relationship table through user role _ verify _ user1 to determine that the workflow is a process initial review by querying the user permission workflow view constructed in the foregoing; then, querying task which can be processed by the process initial review post; so that task _ user1 can be queried by role _ verify _ user 1.

Similarly, the roles are the user role _ verify _ user2 and role _ verify _ user3 for the initial review of the process, and can also be referred to as task _ user1, and the query idea is similar to role _ verify _ user 1.

Similarly, a user role _ recheck _ user1 with the role of the process review post logs in the system and then refers to the task to be handled, and cannot refer to task _ user 1; the reason why the task _ user1 is not queried by the flow review post is that the aforementioned flow specifies that the handler role is the review role during the commit phase.

If the system administrator adds a new role as the new employee user role _ verify _ user4 of the process initial review post at this time. Obviously, the system administrator adds specific operations by adding data in the business data table space. The user role _ verify _ user4 with the role of the flow pre-review post queries the task to be handled, at this time, the query is performed in the workflow data table space, and since the view mapping updated on any user role authority data in the workflow data table space is effectively mapped to the workflow data table space in real time, the user role _ verify _ user4 can refer to the task _ user1 when querying in the workflow data table space.

(3) After the user role _ verify _ user4 gets the task _ user1, the user role _ verify _ user4 checks the task to be handled again, and at this time, the user role _ verify _ user4 does not have the task to be handled; if the user role _ verify _ user4 checks the history processing task, there is a task _ user1 task. Similarly, the tasks of task _ user1 cannot be referred to when the users role _ verify _ user 1-role _ verify _ user3 in the initial process review post view their tasks to be handled again, because the task is already taken by other users role _ verify _ user4 in the same role.

(4) And the role is that a user role _ verify _ user4 on the process initial review post receives the task and then performs task review, and the review is passed. The role _ verify _ user4 can specify that the next role to process the current task is the process review post before auditing; at which time the phase of task _ user1 changes from the commit phase to the review phase.

(5) The review stage is similar to the steps (2) - (4), the user role _ review _ user1 of the process review post queries the task and gets the task, and the task processing rules and the calling method are the same as the above until the task is finished.

According to a second aspect of the embodiments of the present invention, there is provided an apparatus for implementing the above method.

Fig. 2 is a schematic diagram of main modules of a device for workflow management according to an embodiment of the present invention, and as shown in fig. 2, the device 200 for workflow management includes:

a service system user authority management module 201, which constructs a user authority service table of the service system in the service data table space;

the user permission adaptation module 202 is used for constructing a user permission adaptation table of a cross-table space;

the workflow system user authority management module 203 constructs a user authority workflow view of the workflow system in a workflow data table space according to the user authority service table and the user authority adaptation table;

and the workflow system execution module 204 executes the workflow according to the user authority workflow view.

The workflow management apparatus according to the embodiment of the present invention will be described below by way of example with reference to fig. 3 and 4. As shown in fig. 3, the means for workflow management comprises: the system comprises an S001 application aggregation core service module, an S002 service system user permission management module, an S003 user permission adaptation module, an S004 workflow system user permission management module, an S005 workflow system flow definition module, an S006 workflow system flow instance management module, an S007 workflow system task management module, an S008 workflow system history query module, an S009 service and workflow parameter configuration module and an S010 workflow system flow design module. Obviously, the workflow system execution module 204 includes an S005 workflow system flow definition module, an S006 workflow system flow instance management module, an S007 workflow system task management module, an S008 workflow system history query module, an S009 business and workflow parameter configuration module, an S010 workflow system flow design module, and the like.

Suppose that a database storing business data and workflow data is called database _ bank, data of a business system exists in a tablespace bussinesstablespace of the database _ bank, and information related to a workflow component exists in another tablespace workflow _ tablespace of the database _ bank. The notation "bussiness _ table space. bussiness _ id _ user" means: and the data table business _ id _ user stored in the business _ tablespace.

Meanwhile, it is assumed that five service groups exist in the service system, and the corresponding five roles are respectively: the process initiator role _ starter, the process initial review role _ verify, the process re-review role _ repeat, the department leader role _ leader, and the legal approval role _ law. The method includes that a role related to a certain service approval workflow verify _ workflow is only three, namely a process initiator roll _ starter, a process initial approval post r ole _ verify and a process re-check post roll _ repeat, and a department leader roll _ leader and a legal approval roll _ law in a service system are irrelevant to the process. There are three users with role _ starter flow initiator, which are: role _ start _ user1, role _ start _ user2, ro le _ start _ user 3. The role is three users of process initial review role _ verify, which are respectively: role _ verify _ user1, role _ verify _ user2, role _ verify _ user 3. The role of the user with the flow review role _ resume is three, which are respectively: role _ recheck _ user1, role _ recheck _ user2, role _ recheck _ user 3. The user role _ recheck _ user3 of the role _ recheck post role cannot undertake the examination and approval work (illness, leave, work out, etc.) in the verify _ workflow flow process due to uncontrollable factors. A new employee user, role _ verify _ user4, is not in any of the three roles of approval process verify _ workflow, but from the god perspective, when a process is executed at a time in the future, he is added to role _ verify by the team administrator. Obviously, the data related to the service is stored in the table space bussinesstablespace of the database _ bank.

1. And the system administrator starts the S001 application aggregation core service module, and the service starting can finish the starting and initialization work of the S002-S010 modules.

The system administrator can set configuration parameters of the S009 service and workflow parameter configuration module as follows through a preset interface when starting up for the first time: db-identity-used ═ false. And simultaneously setting configuration parameters of an S003 user permission adaptation module, including: role white list: change _ workfl _ whitelist ═ role _ start, role _ change, role _ resume }; and (3) user blacklist: verify _ workflow _ blacklist ═ role _ resume _ user3 }; time constraints for workflow execution: v erify _ workflow _ timelimit ═ {9:00-18:00 }.

2. This section details the Optimization Strategy of unified management of User identity based on Database Cross-tablespace View Mapping (Optimization Stratagy of User identification unified management based on Database View Mapping of Cross T usable space, OSUIMDVMCT Strategy) in the embodiment of the present invention. The implementation of the OSUIMDVMCT strategy is completed by the cooperation of the S002 service system user authority management module, the S003 user authority adaptation module and the S004 workflow system user authority management module.

The S002 service system user right management module includes but is not limited to the following three database tables: service user table: business _ id _ user, service group table: business _ id _ group, business user and group relation table: burst _ id _ membership. And the data of the S002 service system user authority management module is stored in the tablespace business _ tablespace of database.

The S004 workflow system user right management module includes but is not limited to the following three database tables: workflow user table: act _ id _ user, workflow group table: act _ id _ group, workflow user and group relationship table: act _ id _ membership. And the data of the user authority management module of the S004 workflow system is stored in a tablespace workflow _ tablespace of database _ bank. It should be noted that, in the embodiment of the present invention, the data of the tablespace workflow _ tablespace is not used, and instead, the optimization policy is uniformly managed based on the user identity mapped by the database across tablespace views.

The core steps of the OSUIMDVMCT strategy comprise:

(1) defining a filtering condition of a verify _ workflow in an S003 user permission adaptation module, wherein the filtering condition specifically comprises the following steps:

the workflow role white list is:

verify_workflow_whitelist＝{role_starter,role_verify,role_recheck}

the role user blacklist is:

verify_workflow_blacklist＝{role_recheck_user3}

the time constraint for workflow execution is:

verify_workflow_timelimit＝{9:00-18:00}。

for the personalized control of the roles, the users and other scenes, special, personalized and workflow-related data screening conditions can be stored in a data table associated with the user permission adaptation module in a persistent mode. The embodiment of the invention assumes that the data table associated with the user right adaptation module is located in a business _ desktop _ workflow _ biz _ adapter table.

(2) In the S004 workflow system user authority management module, three tables of act _ id _ user, act _ id _ group and act _ id _ membership in the table space workfl ow _ tablespace are deleted. Because db-identity-used is set as false in the parameter configuration step, the start check and the exception prompt of the workflow start self-check stage are performed without checking whether the three physical tables exist any more when the workflow system service is started. The meaning of the parameter "db-identity-used" is to allow the active open source component to not check the existence of the three tables when initializing the process engine.

The rule for starting verification and exception reminding after the db-identity-used parameter configuration belongs to the common general knowledge in the workflow field, and the active component activti in the industry also has a mature active implementation, and details of engineering implementation thereof are not described herein.

(3) The administrator gives authority to read tables such as business _ desktop, business _ biz _ adapter, business _ desktop, business _ id _ user, business _ desktop, business _ id _ group, and business _ id _ membership to the business _ desktop by logging in the tablespace business _ desktop. For example, the following database sql is implemented:

grant select on business_tablespace.business_id_user to workflow_tablespace

bussinessjdususerswaccess may be granted workflow _ tablespace. So on, it is not repeated.

The above-mentioned cross-table space read permission grant is necessary and is an important component of database security and permission protection. Different tablespace data access interworking is the basis for subsequent operations.

(4) Combining adaptation and user data of a business table space, logging in the table space workflow _ t-enabled space to establish a view virtual table, mapping users and adaptation data of an S002 business system user authority management module and an S003 user authority adaptation module to construct a virtual table, mapping the virtual table to work f low _ tablespace, and generating a new table: workflow user View: act _ id _ user; workflow group view: act _ id _ group; workflow user and group relationship views: act _ id _ membership. The three constructed views are used to replace the three physical tables with the same name deleted in the previous step. Taking a ct _ id _ user as an example, the act _ id _ user at this time represents a view virtual table, not a real physical table.

By deleting the physical table and constructing a view virtual table, only one user and identity data are stored in the service system and the workflow system, so that the user authority data of the service system and the user authority data of the workflow system are unified in real time; by constructing the mapping association relationship of the virtual table view, any real-time modification of the user authority data of the business system can be synchronized and refreshed in real time in the user authority data of the workflow system without difference. Thus, a unified user identity authority management strategy is constructed. Specifically, for example, the mapping logic for constructing the act _ id _ user table view may be configured in such a way that, one of optional operation methods is to log in the tablespace workflow _ tablespace, and the administrator executes an sql statement similar to the following statement:

CREATE OR REPLACE VIEW workflow_tablespace.act_id_user

(id_,rev_,first_,last_,email_,pwd_,picture_id)

AS SELECT

utl_raw.cast_to_nvarchar2(utl_raw.cast_to_raw(translate(a1.id_usingnchar_cs))),

to_number(a1.rev_),

utl_raw.cast_to_nvarchar2(utl_raw.cast_to_raw(translate(a1.first_using nchar_cs))),

utl_raw.cast_to_nvarchar2(utl_raw.cast_to_raw(translate(a1.last_using nchar_cs))),

utl_raw.cast_to_nvarchar2(utl_raw.cast_to_raw(translate(a1.email_pswd using nchar_cs))),

utl_raw.cast_to_nvarchar2(utl_raw.cast_to_raw(translate(a1.pwd_usi ngnchar_cs))),

utl_raw.cast_to_nvarchar2(utl_raw.cast_to_raw(translate(a1.picture_id using nchar_cs))),

from business_tablespace.business_id_user a1,

business_tablespace.business_id_membership a2 where a1.usr_id＝a2.usr_id and a2.rl_id in business_tablespace.verify_workflow_whitelist

the sql maps the business _ id _ user data of the service table space to act _ id _ user of the workflow _ ta blespace, and meanwhile, role white list verification is carried out. The view mapping here uses the S003 user permission adaptation module. By analogy, more complex checks are performed according to the dummy table and the adaptive mapping criteria, and the details of the engineering implementation thereof are not described in detail herein.

The significance of the S003 user permission adaptation module is that the service data, like workflow data mapping, will substitute for sensitive or uncontrollable extra data, and when the differentiated hierarchical control needs to be refined, the S003 user permission adaptation module more like a role, user, permission filter, in this example, by passing through

verify_workflow_whitelist＝{role_starter,role_verify,role_recheck}

verify_workflow_blacklist＝{role_recheck_user3}

verify_workflow_timelimit＝{9:00-18:00}

The mapping of the business _ tablespace view to the workflow _ tablespace is controlled, so that irrelevant roles, special crowds and sensitive operation time are filtered out in the mapping process, and the usability of system operation is enhanced. Obviously, the workflow cannot be developed and performed without the version _ workflow _ timelimit time range.

In a real large financial system, the roles may be thousands of, and if not filtered, mapping tens of thousands of roles to workflow representations is not preferable, information leakage or irrelevant data interference may be caused. In this example, there are only three roles associated with the workflow, so the workflow system is a pure clean and compliant group of workflow users that are taken after data filtering, sensitive information culling, and legitimate time filtering. Other schemes that facilitate user right adaptation and filtering, but facilitate enhanced workflow data cleansing, may be implemented via the user right adaptation table.

It should be noted that since three physical tables of the actirti standard have been deleted, a view mapping relationship is now constructed, all user right management is not required to be maintained in the workflow _ tablespace of the Acitivi workflow module in the future, and the user identity right management is maintained in all business _ tablespace; the user management of the Activiti workflow is decoupled from the service logic, and the Activiti can pay more attention to the processing of the workflow logic without maintaining the user identity information.

3. The process initiator role _ start _ user1 with role _ start initiates a verify _ workflow through the web or app program interface provided by the S005 workflow system process definition module. At this time, the S006 workflow system process instance management module is triggered to construct a new workflow instance. The workflow instance is determined by an S010 workflow system flow design module. The design drawing stored by the process design module of the S010 workflow system is a file with a suffix of bpmn generated after a process or business personnel interacts, drags and clicks a drawing process drawing through an interface, and the essence of the file is also the process description information normalized by the xml pre-research. In the present example, to illustrate the essence of its implementation and design, the design drawings are indicated only by simple text arrows:

start phase →

Commit phase (process role) →

Audit phase (role _ verify) →

Check phase (process role) →

And (6) ending.

The S010 workflow system process design module generates and analyzes rules through graphical click dragging, belongs to the common general knowledge in the workflow field, and has mature open source realization in the industry, and details of engineering realization thereof are not described herein.

4. The flow initiator role _ start _ user1, whose role is role _ start, initiates a flow and commits a task, which is defined as task _ user 1. At which time the phase of task _ user1 changes from the issue phase to the commit phase.

At the time of initiating the flow submission task, the role _ startup _ user1 may specify that the next role to process the current task is role _ verify. When the engineering is realized, the above specification can be specified in the parameter configuration of the workflow system flow design module of S012, and also can be specified in the modes of variable transmission and function call; in any case, it is clear that the processing role in the next stage of auditing is role _ verify.

5. After logging in the workflow system, the user role _ verify _ user1 with the role of role _ verify refers to the task to be handled through the task management module of the workflow system S007, and may refer to the task _ user 1. The query concept is a virtual table query using the osuimdmct policy described in section 2.

In the OSUIMDVMCT strategy, an Activiti workflow task query function interface is called, the function interface queries the virtual user permission workflow view table constructed in the foregoing manner, and queries the role of the role _ verify _ user1 user as role _ verify in the act _ id _ membership table through the user role _ verify _ user 1. Then, inquiring task which can be processed by the role _ verify; so that task _ user1 can be queried by role _ verify _ user 1.

Similarly, the users role _ version _ user2 and role _ version _ user3 with the same role as role _ version can also refer to task _ user1, and the query idea is similar to role _ version _ user 1.

Similarly, if the user role _ resume _ user1, whose role is the process review role _ resume, refers to the task to be done after logging in the system, it cannot refer to task _ user1, because the process specifies that the handler role is the review role in the submission stage.

6. If the service system administrator adds a new employee user role _ verify _ user4 with role _ verify role at this time. Obviously, the specific operation added by the service system administrator is realized by adding data in the table space bussiness _ tablespace.

7. The user role _ verify _ user4 with role _ verify inquires about the task to be done. At this time, the query is performed on the workflow _ table, and because the aforementioned osuimedvmct policy makes the view mapping updated on the table space business _ table for any user role permission data effective in real time, the user role _ verify _ user4 may refer to the task _ user1 when querying the workflow _ table. The user role _ verify _ user4 further operates on the page, and gets the task _ user1 through the get task function interface of the S007 workflow system task management module.

And looking at the task to be handled again, the user role _ verify _ user4 does not have the task to be handled at this time. If the user role _ verify _ user4 checks the history processing task through the S008 workflow system query module, there is a task _ user1 task.

Similarly, when the user role _ verify _ user 1-role _ verify _ u ser3 with the same role as role _ verify look at the task to be handled again, the task _ user1 cannot be looked up, because the task is already picked up by other user role _ verify _ user4 with the same role.

8. And after the user role _ verify _ user4 with the role of role _ verify gets the task, calling a task auditing function interface of the task management module of the S007 workflow system to audit the task, and enabling the audit to pass. role _ verify _ user4 may specify that the role next to process the current task is role _ resume before auditing. At which time the phase of task _ user1 changes from the commit phase to the review phase.

9. The review stage is similar to the above steps, the user role _ review _ user1 of the role _ review of the process review post queries and picks up the task, and the task processing rules and the calling method are the same as those described above until the task is finished, which is not repeated again.

In the embodiment, a dedicated workflow database table space is constructed through an OSUIMDVMCT strategy, hierarchical, differential and independent management is performed on the dedicated workflow database table space and the service data table space, the relevance between the dedicated workflow database table space and the service data table space can be decoupled from a data model, and the read-write permission and the safety of the workflow sensitive data are enhanced; the method comprises the steps of constructing a cross-table space user authority view, realizing unified management of user identity authorities of a service system and a workflow system, and solving the problem of inconsistent reading and writing caused by the problem that the existing Acitiviti workflow needs to maintain synchronization of multiple user identity authorities at the same time; meanwhile, when personnel identity information and authority information are changed in the business system, under the condition of not changing any data configuration and software codes of the workflow system, the non-inductive and real-time data mapping and synchronization to the workflow execution logic are quickly and efficiently realized; by means of the Activiti workflow system with unified user identity and authority management, usability, high expandability, modular assembly capacity and convenience of large-scale commercial implementation of the Acitiviti workflow can be greatly improved.

one or more processors;

a storage device for storing one or more programs,

Fig. 5 illustrates an exemplary system architecture 500 of an apparatus to which the method of workflow management or workflow management of an embodiment of the invention may be applied.

As shown in fig. 5, the system architecture 500 may include

terminal devices

501, 502, 503, a network 504, and a server 505. The network 504 serves to provide a medium for communication links between the

terminal devices

501, 502, 503 and the server 505. Network 504 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.

The user may use the

terminal devices

501, 502, 503 to interact with a server 505 over a network 504 to receive or send messages or the like. The

terminal devices

501, 502, 503 may have installed thereon various communication client applications, such as shopping applications, web browser applications, search applications, instant messaging tools, mailbox clients, social platform software, etc. (by way of example only).

The

terminal devices

501, 502, 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 505 may be a server providing various services, such as a background management server (for example only) providing support for shopping websites browsed by users using the

terminal devices

501, 502, 503. The backend management server may analyze and perform other processing on the received data such as the product information query request, and feed back a processing result (for example, target push information, product information — just an example) to the terminal device.

It should be noted that the method for workflow management provided by the embodiment of the present invention is generally executed by the server 505, and accordingly, the device for workflow management is generally disposed in the server 505.

It should be understood that the number of terminal devices, networks, and servers in fig. 5 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

Referring now to FIG. 6, a block diagram of a computer system 600 suitable for use with a terminal device implementing an embodiment of the invention is shown. The terminal device shown in fig. 6 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present invention.

As shown in fig. 6, the computer system 600 includes a Central Processing Unit (CPU)601 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)602 or a program loaded from a storage section 608 into a Random Access Memory (RAM) 603. In the RAM 603, various programs and data necessary for the operation of the system 600 are also stored. The CPU 601, ROM 602, and RAM 603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.

To the I/O interface 605, AN input section 606 including a keyboard, a mouse, and the like, AN output section 607 including a network interface card such as a Cathode Ray Tube (CRT), a liquid crystal display (L CD), and the like, a speaker, and the like, a storage section 608 including a hard disk, and the like, and a communication section 609 including a network interface card such as a L AN card, a modem, and the like, the communication section 609 performs communication processing via a network such as AN internet, a drive 610 is also connected to the I/O interface 605 as necessary, a removable medium 611 such as a magnetic disk, AN optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 610 as necessary, so that a computer program read out therefrom is mounted into the storage section 608 as necessary.

In particular, according to the embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such embodiments, the computer program may be downloaded and installed from a network through the communication section 609, and/or installed from the removable medium 611. The computer program performs the above-described functions defined in the system of the present invention when executed by the Central Processing Unit (CPU) 601.

It should be noted that the computer readable medium shown in the present invention can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present invention, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The modules described in the embodiments of the present invention may be implemented by software or hardware. The described modules may also be provided in a processor, which may be described as: a processor comprising: the service system user authority management module is used for constructing a user authority service table of the service system in the service data table space; the user permission adaptation module is used for constructing a user permission adaptation table of a cross-table space; the workflow system user authority management module is used for constructing a user authority workflow view of the workflow system in a workflow data table space according to the user authority service table and the user authority adaptation table; and the workflow system execution module executes the workflow according to the user authority workflow view. Where the names of these modules do not in some cases constitute a definition of the module itself, for example, a business system user rights management module may also be described as a "module that builds a user rights workflow view of the workflow system in a workflow data sheet space".

As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be separate and not incorporated into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to comprise: constructing a user authority service table of a service system in a service data table space; constructing a user permission adaptation table of a cross-table space; and constructing a user authority workflow view of the workflow system in a workflow data table space according to the user authority service table and the user authority adaptation table so that the workflow system executes a workflow according to the user authority workflow view.

According to the technical scheme of the embodiment of the invention, by constructing the exclusive workflow data table space and carrying out hierarchical, differential and independent management with the service data table space, the relevance of the service flow and the service data can be decoupled, and the read-write permission and the safety of the workflow sensitive data are enhanced; by constructing a user authority view of a cross-table space, unified management of user identity authorities of a business system and a workflow system is realized, imperceptible and real-time data mapping and synchronization to workflow execution logic are realized quickly and efficiently, and usability, expansibility, modularization capability of assembly and convenience of large-scale commercial implementation of the workflow are improved greatly.

The above-described embodiments should not be construed as limiting the scope of the invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations, and substitutions may occur depending on design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method of workflow management, comprising:

constructing a user permission adaptation table of a cross-table space;

2. The method of claim 1, wherein after constructing the service table of user permissions of the service system in the service data table space, further comprising: and updating the user authority service table.

3. The method of claim 1, wherein the workflow system executes a workflow according to the user rights workflow view, comprising:

4. A method according to any of claims 1-3, wherein the user rights service table comprises: a service user table, a service group table, a service user and group relation table; the user permission workflow view comprises: a workflow user view, a workflow group view, a workflow user and group relationship view.

5. A method according to any of claims 1-3, wherein the user permission adaptation table comprises at least one of: workflow role whitelist, workflow role blacklist, time constraints for workflow execution.

6. An apparatus for workflow management, comprising:

7. The apparatus of claim 6, wherein the business system user rights management module is further to: and after a user authority service table of the service system is constructed in the service data table space, updating the user authority service table.

8. The apparatus of claim 6, wherein the workflow system execution module executes a workflow according to the user permission workflow view, comprising:

9. The apparatus of any of claims 6-8, wherein the user rights service table comprises: a service user table, a service group table, a service user and group relation table; the user permission workflow view comprises: a workflow user view, a workflow group view, a workflow user and group relationship view.

10. The apparatus of any of claims 6-8, wherein the user permission adaptation table comprises at least one of: workflow role whitelist, workflow role blacklist, time constraints for workflow execution.

11. An electronic device for workflow management, comprising:

one or more processors;

a storage device for storing one or more programs,

when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-5.

12. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-5.