Detecting and Resolving Conflicts of Mutual-Exclusion and Binding Constraints in a Business Process Context

Abstract

Abstract. Mutual exclusion and binding constraints are important means to define which combinations of subjects and roles can be assigned to the tasks that are included in a business process. Due to the combinatorial complexity of potential role-to-subject and task-to-role assignments, there is a strong need to systematically check the consistency of a given set of constraints. In this paper, we discuss the detection of consistency conflicts and provide resolution strategies for the corresponding conflicts.

On the Impact of Concurrency for the Enforcement of Entailment Constraints in Process-driven SOAs

“…In a process-driven SOA, the respective process engine must ensure the consistency of process-related RBAC models (see, e.g., [11]). In particular, it must enforce the entailment constraints and ensure the static (design-time) and dynamic (runtime) correctness of the corresponding models to prevent constraint conflicts or inconsistencies (see, e.g., [19,20]). Figures 1 and 2 show a simplified example of a business process that is executed via a process-driven SOA.…”

“…In order to perform the different tasks, the subjects invoke corresponding software services. If, for instance, there is a subject-binding between t a and t f and a DME constraint between t a and t e (see Figure 2), the respective process engine must ensure that for each process instance p i , the corresponding task instances t ai and t fi are allocated to the same subject while the task instances t ai and t ei are allocated to different subjects (see, e.g., [19,20] …”

“…In the context of our work on the specification and enforcement of entailment constraints in business processes (see, e.g., [11,[19][20][21]), we implemented a corresponding runtime engine. Our runtime engine ensures the consistency of business processes with corresponding entailment constraints at the type-level (design-time) and at the instance-level (runtime).…”

“…For example, if the tasks t a and t e from Figure 4(b) are mutually exclusive, the choreography engine of domain y needs to know which subject was allocated to an instance of t a to correctly allocate instances of t e (see, e.g., [19,20] Figure 1. It illustrates the process flow and the message exchange that is necessary to allocate task instances at runtime.…”

“…Bertino et al [5], propose a language for expressing entailment constraints and algorithms to check the consistency of these constraints while assigning roles and users to workflow tasks. Similarly, Schefer et al [19] discuss resolution strategies for conflicts of process-related mutual-exclusion and binding constraints before these conflicts cause an inconsistent RBAC configuration. Xu et al [27] consider concurrency in access control decisions through the development of XACML-ARBAC, a language to resolve the concurrency problem.…”