Pattern-Based Approach to the Workflow Satisfiability Problem with User-Independent Constraints

Abstract

The fixed parameter tractable (FPT) approach is a powerful tool in tackling computationally hard problems. In this paper, we link FPT results to classic artificial intelligence (AI) techniques to show how they complement each other. Specifically, we consider the workflow satisfiability problem (WSP) which asks whether there exists an assignment of authorised users to the steps in a workflow specification, subject to certain constraints on the assignment. It was shown by Cohen et al. (JAIR 2014) that WSP restricted to the class of user-independent constraints (UI), covering many practical cases, admits FPT algorithms, i.e. can be solved in time exponential only in the number of steps k and polynomial in the number of users n. Since usually k ≪ n in WSP, such FPT algorithms are of great practical interest.We present a new interpretation of the FPT nature of the WSP with UI constraints giving a decomposition of the problem into two levels. Exploiting this two-level split, we develop a new FPT algorithm that is by many orders of magnitude faster than the previous state-of-the-art WSP algorithm and also has only polynomial-space complexity. We also introduce new pseudo-Boolean (PB) and Constraint Satisfaction (CSP) formulations of the WSP with UI constraints which efficiently exploit this new decomposition of the problem and raise the novel issue of how to use general-purpose solvers to tackle FPT problems in a fashion that meets FPT efficiency expectations. In our computational study, we investigate, for the first time, the phase transition (PT) properties of the WSP, under a model for generation of random instances. We show how PT studies can be extended, in a novel fashion, to support empirical evaluation of scaling of FPT algorithms. 1 or cross-checking of work, etc. [4, 16, 47, 50]. Furthermore, different users have different capabilities and security permissions, and will generally not be authorised to process all of the steps. In the Workflow Satisfiability Problem (WSP), the aim is to assign authorised users to the steps in a workflow specification, subject to constraints arising from business rules and practices. (Note the term "workflow" originally arose from the flow of the steps between users, however, in this context, the time ordering is not relevant -the challenge is to make a feasible assignment for all the steps.) The WSP has important applications and has been extensively studied in the security research community [4,5,6,14,15,17,18,25,50].The WSP is NP-complete, and it has been difficult to solve, even for some moderately-sized instances [12,47]. Work in WSP has attempted to render solving of the WSP practical by finding a subclass of problems that admit fixed parameter tractable (FPT) algorithms; informally speaking, this means that there is a small parameter k such that the problem is exponential in k but polynomial in the size of the problem. In the case of the WSP, the parameter k is naturally the number of steps -in real-life instances this number is usually much smaller than the number n of u...

Algorithms for Workflow Satisfiability Problem with User-independent Constraints

“…The algorithms below were introduced in [15] called blocks such that every step in each S i is assigned to the same user, but steps in dierent S i 's are assigned to dierent users. For a plan π : S → U and…”

“…Such a procedure depends on the types of constraints used in the WSP instances under consideration. For such a procedure and further particulars of the algorithm, see Karapetyan et al [15].…”

“…Our aim is to decide whether all steps can be assigned to users This paper is an extended version of a conference paper [12]. The main addition is Section 5 where we discuss computational experiments performed with two testbeds which contain instances that are closer to real-world ones than those used in [15]. such that all authorizations and constraints are satised, i.e., the instance is satisable or not.…”

“…All constraints considered by Wang and Li [19] and many other WSP researchers are UI; in fact, all constraints listed by American National Standards Institute in [1] are UI. Cohen et al [3] introduced and studied an algorithm for the WSP with only UI constraints, which is FPT but of exponential space in k. Karapetyan, Parkes, Gutin and Gagarin [15] introduced another FPT algorithm for the WSP with only UI constraints, which is of polynomial space and much more ecient in practical computing than that in [3]. A key ingredient of the algorithm of Karapetyan et al is the use of maximum matchings in specially constructed bipartite graphs to decide on authorizations.…”

Bounded and Approximate Strong Satisfiability in Workflows

“…Another difference between [5] and our paper is that while [5] uses an off-the-shelf Optimization Modulo Theories solver, we design a specialised FPT algorithm. Note that several papers including [12] and the very recent [19] showed that FPT algorithms are superior to various off-the-shelf decision and optimization solvers at solving WSP-related problems.…”