Iterative Plan Construction for the Workflow Satisfiability Problem

Abstract

The \emph{Workflow Satisfiability Problem (WSP)} is a problem of practical interest that arises whenever tasks need to be performed by authorized users, subject to constraints defined by business rules. We are required to decide whether there exists a \emph{plan} -- an assignment of tasks to authorized users -- such that all constraints are satisfied. Several bespoke algorithms have been constructed for solving the WSP, optimised to deal with constraints (business rules) of particular types. It is natural to see the WSP as a subclass of the {\em Constraint Satisfaction Problem (CSP)} in which the variables are tasks and the domain is the set of users. What makes the WSP distinctive as a CSP is that we can assume that the number of tasks is very small compared to the number of users. This is in sharp contrast with traditional CSP models where the domain is small and the number of variables is very large. As such, it is appropriate to ask for which constraint languages the WSP is fixed-parameter tractable (FPT), parameterized by the number of tasks. We have identified a new FPT constraint language, user-independent constraint, that includes many of the constraints of interest in business processing systems. We are also able to prove that the union of FPT languages remains FPT if they satisfy a simple compatibility condition. In this paper we present our generic algorithm, in which plans are grouped into equivalence classes, each class being associated with a \emph{pattern}. We demonstrate that our generic algorithm has running time $O^*(2^{k\log k})$, where $k$ is the number of tasks, for the language of user-independent constraints. We also show that there is no algorithm of running time $O^*(2^{o(k\log k)})$ for user-independent constraints unless the Exponential Time Hypothesis fails

Engineering Algorithms for Workflow Satisfiability Problem with User-Independent Constraints

“…In line 12 we have to compute the pattern for the extended plan and add it to the list Π u of extended plans. As we noted in the previous section, results by Cohen et al [4] assert that these subroutines can be computed efficiently.…”

“…In particular, we define an equivalence relation on the set of all possible plans. This equivalence relation is determined by the particular set of constraints under consideration [4]. In the case of user-independent constraints, two partial plans π : T → X and π : T → X are equivalent, denoted by π ≈ π , if and only if T = T and for all s, t ∈ T , π(s) = π(t) if and only if π (s) = π (t).…”

“…Cohen et al [4] show that such algorithms exist for user-independent constraints, essentially because the set of patterns admits a natural lexicographic order.…”

“…We call this the workflow satisfiability problem. This problem has been studied extensively in the security community [2,5,16] and more recently as an interesting algorithmic problem [4,7].…”

“…Cohen et al recently designed a generic WSP algorithm and proved that the algorithm is fixed-parameter for WSP restricted to the class of user-independent constraints [4]. Informally, a constraint c is user-independent if, given a plan π that satisfies c and any permutation φ : U → U , the plan π : S → U , where π (s) = φ(π(s)), also satisfies c. Almost all constraints studied in [7,16] and other papers are user-independent (since the separation-of-duty constraints are user-independent, WSP restricted to the class of user-independent constraints is NP-hard).…”