Automated Synthesis of Run-time Monitors to Enforce Authorization Policies in Business Processes

Bertolissi, Clara; Santos, Daniel Ricardo dos; Ranise, Silvio

doi:10.1145/2714576.2714633

Cited by 18 publications

(35 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…First, we give precise statements of two SFPs together with a discussion of their relationships with the WSP (Section 2). Second, we describe techniques to solve them by adapting the technique for the synthesis of run-time monitors for the WSP developed in [5] (Section 3). Third, we validate our solutions on real-world examples from a library of re-usable business process models (Section 4).…”

Section: Example 1 (Trip Request Workflow (Trw))mentioning

confidence: 99%

“…We now briefly recall the technique in [5] to synthesize run-time monitors solving the WSP. This is important as it provides us with a compact data structure to represent the set of all eligible scenarios in a workflow, which is crucial for the design of an efficient solution to SFPs.…”

Section: From Solving the Wsp To Solving Sfpsmentioning

confidence: 99%

“…A non-recursive Datalog program M with negation is derived from the symbolic reachability graph RG by building a clause of the form can do(υ, t) ← β v where β v is the formula labeling node v in RG. (For more details on how M is built, the interested reader is pointed to [5]). The formula β v contains invocations to the binary predicates auth and h. The former is the interface to the authorization policy and such that auth(u, t) holds iff (u, t) ∈ TA while the latter keeps track of which user has executed which task, i.e.…”

Section: From Solving the Wsp To Solving Sfpsmentioning

confidence: 99%

“…For the time being, let us ignore the additional input set Γ (by setting it to ∅); it will be explained later. The main idea underlying the algorithm is to adapt a standard Depth-First Search (DFS) algorithm to explore all well-formed paths in the reachability graph RG while checking that the scenario associated to the path is indeed authorized by using the run-time monitor, synthesized in the on-line phase of the technique in [5]. Lines 1-2 are the standard initialization phase of a DFS algorithm in which all nodes in RG (returned by the function Nodes) are marked as not yet visited.…”

Section: Solving the Sfpsmentioning

confidence: 99%

“…We did this by running the implementation of the off-line step (described in Section 3) from [5]. For the TRW, the symbolic reachability graph is computed in around a second and contains 46 nodes with 81 edges.…”

Section: Validation Of the Techniquementioning

confidence: 99%

See 4 more Smart Citations

Assisting the Deployment of Security-Sensitive Workflows by Finding Execution Scenarios

Santos

Ranise

Compagna³

et al. 2015

Data and Applications Security and Privacy XXIX

Self Cite

View full text Add to dashboard Cite

Abstract. To support the re-use of business process models, an emerging trend in Business Process Management, it is crucial to assist customers during deployment. We study how to do this for an important class of business processes, called security-sensitive workflows, in which execution constraints on the tasks are complemented with authorization constraints (e.g., Separation of Duty) and authorization policies (constraining which users can execute which tasks). We identify the capability of solving Scenario Finding Problems (SFPs), i.e. finding concrete execution scenarios, as crucial in supporting the re-use of security-sensitive workflows. Solutions of SFPs provide evidence that the business process model can be successfully executed under the policy adopted by the customer. We present a technique for solving two SFPs and validate it on real-world business process models taken from an on-line library.

show abstract

Section: Example 1 (Trip Request Workflow (Trw))mentioning

confidence: 99%

Section: From Solving the Wsp To Solving Sfpsmentioning

confidence: 99%

Section: From Solving the Wsp To Solving Sfpsmentioning

confidence: 99%

Section: Solving the Sfpsmentioning

confidence: 99%

Section: Validation Of the Techniquementioning

confidence: 99%

See 3 more Smart Citations

Assisting the Deployment of Security-Sensitive Workflows by Finding Execution Scenarios

Santos

Ranise

Compagna³

et al. 2015

Data and Applications Security and Privacy XXIX

Self Cite

View full text Add to dashboard Cite

show abstract

A Declarative Framework for Specifying and Enforcing Purpose-Aware Policies

Masellis

Ghidini

Ranise

2015

Security and Trust Management

Self Cite

View full text Add to dashboard Cite

Abstract. Purpose is crucial for privacy protection as it makes users confident that their personal data are processed as intended. Available proposals for the specification and enforcement of purpose-aware policies are unsatisfactory for their ambiguous semantics of purposes and/or lack of support to the run-time enforcement of policies. In this paper, we propose a declarative framework based on a first-order temporal logic that allows us to give a precise semantics to purpose-aware policies and to reuse algorithms for the design of a run-time monitor enforcing purpose-aware policies. We also show the complexity of the generation and use of the monitor which, to the best of our knowledge, is the first such a result in literature on purpose-aware policies.

show abstract

Assisted Authoring, Analysis and Enforcement of Access Control Policies in the Cloud

Morelli

Ranise

2017

ICT Systems Security and Privacy Protection

Self Cite

View full text Add to dashboard Cite

Automated Synthesis of Run-time Monitors to Enforce Authorization Policies in Business Processes

Cited by 18 publications

References 23 publications

Assisting the Deployment of Security-Sensitive Workflows by Finding Execution Scenarios

Assisting the Deployment of Security-Sensitive Workflows by Finding Execution Scenarios

A Declarative Framework for Specifying and Enforcing Purpose-Aware Policies

Assisted Authoring, Analysis and Enforcement of Access Control Policies in the Cloud

Contact Info

Product

Resources

About