Assisting the Deployment of Security-Sensitive Workflows by Finding Execution Scenarios

Santos, Daniel Ricardo dos; Ranise, Silvio; Compagna, Luca; Ponta, Serena Elisa

doi:10.1007/978-3-319-20810-7_6

Cited by 5 publications

(7 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The key idea behind the PBT algorithm is that it is not necessary to search the space of plans; it is sufficient to search the space of patterns checking, for each eligible complete pattern, if it is authorised. (This idea was used in the preliminary version [37] of this paper; a similar idea was also exploited by dos Santos et al [24,25] who however use different algorithmic techniques such as Petri nets and Datalog. )…”

Section: Pattern-backtracking Algorithm (Pbt)mentioning

confidence: 97%

Pattern-Based Approach to the Workflow Satisfiability Problem with User-Independent Constraints

Karapetyan¹,

Parkes²,

Gutin³

et al. 2019

jair

View full text Add to dashboard Cite

The fixed parameter tractable (FPT) approach is a powerful tool in tackling computationally hard problems. In this paper, we link FPT results to classic artificial intelligence (AI) techniques to show how they complement each other. Specifically, we consider the workflow satisfiability problem (WSP) which asks whether there exists an assignment of authorised users to the steps in a workflow specification, subject to certain constraints on the assignment. It was shown by Cohen et al. (JAIR 2014) that WSP restricted to the class of user-independent constraints (UI), covering many practical cases, admits FPT algorithms, i.e. can be solved in time exponential only in the number of steps k and polynomial in the number of users n. Since usually k ≪ n in WSP, such FPT algorithms are of great practical interest.We present a new interpretation of the FPT nature of the WSP with UI constraints giving a decomposition of the problem into two levels. Exploiting this two-level split, we develop a new FPT algorithm that is by many orders of magnitude faster than the previous state-of-the-art WSP algorithm and also has only polynomial-space complexity. We also introduce new pseudo-Boolean (PB) and Constraint Satisfaction (CSP) formulations of the WSP with UI constraints which efficiently exploit this new decomposition of the problem and raise the novel issue of how to use general-purpose solvers to tackle FPT problems in a fashion that meets FPT efficiency expectations. In our computational study, we investigate, for the first time, the phase transition (PT) properties of the WSP, under a model for generation of random instances. We show how PT studies can be extended, in a novel fashion, to support empirical evaluation of scaling of FPT algorithms. 1 or cross-checking of work, etc. [4, 16, 47, 50]. Furthermore, different users have different capabilities and security permissions, and will generally not be authorised to process all of the steps. In the Workflow Satisfiability Problem (WSP), the aim is to assign authorised users to the steps in a workflow specification, subject to constraints arising from business rules and practices. (Note the term "workflow" originally arose from the flow of the steps between users, however, in this context, the time ordering is not relevant -the challenge is to make a feasible assignment for all the steps.) The WSP has important applications and has been extensively studied in the security research community [4,5,6,14,15,17,18,25,50].The WSP is NP-complete, and it has been difficult to solve, even for some moderately-sized instances [12,47]. Work in WSP has attempted to render solving of the WSP practical by finding a subclass of problems that admit fixed parameter tractable (FPT) algorithms; informally speaking, this means that there is a small parameter k such that the problem is exponential in k but polynomial in the size of the problem. In the case of the WSP, the parameter k is naturally the number of steps -in real-life instances this number is usually much smaller than the number n of u...

show abstract

Section: Pattern-backtracking Algorithm (Pbt)mentioning

confidence: 97%

Pattern-Based Approach to the Workflow Satisfiability Problem with User-Independent Constraints

Karapetyan¹,

Parkes²,

Gutin³

et al. 2019

jair

View full text Add to dashboard Cite

show abstract

“…In [32], dos Santos et al defined a class of Scenario Finding Problems, which are solutions solving the WSP that also satisfy other properties (e.g., a minimal number of users must be present). Their experimental evaluation involves two real world examples whose size are 7 tasks and 2 SoD constraints, and 9 tasks and 3 SoD constraints, respectively.…”

Section: Related Workmentioning

confidence: 99%

“…Afterwards, in [14], dos Santos et al solved static workflow resiliency by pre-computing reachability graphs by model checking the system, but they didn't address decremental resiliency nor dynamic resiliency. The experimental evaluation involves the same two workflows considered in [32]. Again, while we do not provide a comparison on these two examples for static resiliency as it would not be particularly meaningful, we wish to remark that our approach also addresses decremental and dynamic resiliency.…”

Section: Related Workmentioning

confidence: 99%

Last man standing: Static, decremental and dynamic resiliency via controller synthesis

Zavatteri

Viganò

2019

JCS

View full text Add to dashboard Cite

show abstract

“…This paper is an extended version of [19], with the main additions being the definition of two new SFPs (involving resiliency and constrained scenarios) in Sections 3.3 and 3.4; an expanded description of the solution to the WSP in Section 4.2; new experiments in Section 5; an extensive comparison with related work in Section 6.1; and a description of future work in Section 6.2.…”

Section: Introductionmentioning

confidence: 99%

Automatically finding execution scenarios to deploy security-sensitive workflows

Santos

Ranise

Compagna³

et al. 2017

JCS

Self Cite

View full text Add to dashboard Cite

We introduce a new class of analysis problems, called Scenario Finding Problems (SFPs), for security-sensitive business processes that-besides execution constraints on tasks-define access control policies (constraining which users can execute which tasks) and authorization constraints (such as Separation of Duty). The solutions to SFPs are concrete execution scenarios that assist customers in the reuse and deployment of security-sensitive workflows. We study the relationship of SFPs to well-known properties of security-sensitive processes such as Workflow Satisfiability and Resiliency together with their complexity. Finally, we present a symbolic approach to solving SFPs and describe our experience with a prototype implementation on real-world business process models taken from an on-line library.

show abstract

Assisting the Deployment of Security-Sensitive Workflows by Finding Execution Scenarios

Cited by 5 publications

References 23 publications

Pattern-Based Approach to the Workflow Satisfiability Problem with User-Independent Constraints

Pattern-Based Approach to the Workflow Satisfiability Problem with User-Independent Constraints

Last man standing: Static, decremental and dynamic resiliency via controller synthesis

Automatically finding execution scenarios to deploy security-sensitive workflows

Contact Info

Product

Resources

About