1. Home
  2. Journals
  3. JCS
  4. To appear
  5. Automatically finding execution scenario ...

Journal of Computer Security


Automatically finding execution scenarios to deploy security-sensitive workflows
Pub. online: 5 September 2023      Type: Research Article     
Published
5 September 2023

Abstract

We introduce a new class of analysis problems, called Scenario Finding Problems (SFPs), for security-sensitive business processes that – besides execution constraints on tasks – define access control policies (constraining which users can execute which tasks) and authorization constraints (such as Separation of Duty). The solutions to SFPs are concrete execution scenarios that assist customers in the reuse and deployment of security-sensitive workflows. We study the relationship of SFPs to well-known properties of security-sensitive processes such as Workflow Satisfiability and Resiliency together with their complexity. Finally, we present a symbolic approach to solving SFPs and describe our experience with a prototype implementation on real-world business process models taken from an on-line library.

References

[1] 
A. Adriansyah, B. van Dongen and N. Zannone, Controlling break-the-glass through alignment, ASE Science Journal 2(4) (2013), 198–212.
[2] 
A. Armando and S.E. Ponta, Model checking of security-sensitive business processes, in: Proc. of FAST, Springer, 2009.
[3] 
D. Basin, S.J. Burri and G. Karjoth, Obstruction-free authorization enforcement: Aligning security with business objectives, in: Proc. of CSF, IEEE, 2011.
[4] 
D. Basin, S.J. Burri and G. Karjoth, Optimal workflow-aware authorizations, in: Proc. of SACMAT, ACM, 2012.
[5] 
E. Bertino, E. Ferrari and V. Atluri, The specification and enforcement of authorization constraints in workflow management systems, TISSEC 2 (1999), 65–104. doi:10.1145/300830.300837.
[6] 
C. Bertolissi, D.R. dos Santos and S. Ranise, Automated synthesis of run-time monitors to enforce authorization policies in business processes, in: Proc. of ASIACCS, ACM, 2015.
[7] 
S. Ceri, G. Gottlob and L. Tanca, What you always wanted to know about datalog (and never dared to ask), IEEE TKDE 1(1) (1989), 146–166.
[8] 
D. Cohen, J. Crampton, A. Gagarin, G. Gutin and M. Jones, Iterative plan construction for the workflow satisfiability problem, JAIR 51 (2014), 555–577.
[9] 
L. Compagna, D.R. dos Santos, S.E. Ponta and S. Ranise, Cerberus: Automated synthesis of enforcement mechanisms for security-sensitive business processes, in: Proc. of TACAS, Springer, 2016.
[10] 
J. Crampton, A reference monitor for workflow systems with constrained task execution, in: Proc. of SACMAT, ACM, 2005.
[11] 
J. Crampton, R. Crowston, G. Gutin, M. Jones and M.S. Ramanujan, Fixed-parameter tractability of workflow satisfiability in the presence of seniority constraints, in: Proc. of FAW-AAIM, Springer, 2013.
[12] 
J. Crampton, G. Gutin and D. Karapetyan, Valued workflow satisfiability problem, in: Proc. of SACMAT, ACM, 2015.
[13] 
J. Crampton, G. Gutin, D. Karapetyan and R. Watrigant, The bi-objective workflow satisfiability problem and workflow resiliency, JCS (2016). Preprint.
[14] 
J. Crampton, G. Gutin and R. Watrigant, Resiliency policies in access control revisited, in: Proc. of SACMAT, ACM, 2016.
[15] 
J. Crampton, G. Gutin and A. Yeo, On the parameterized complexity of the workflow satisfiability problem, in: Proc. of CCS, ACM, 2012.
[16] 
J. Crampton, M. Huth and J. Kuo, Authorized workflow schemas: Deciding realizability through LTL(F) model checking, STTT 16(1) (2014), 31–48. doi:10.1007/s10009-012-0269-3.
[17] 
J. de Freitas, Model business processes for flexibility and re-use: A component-oriented approach, Technical report, IBM, 2009.
[18] 
R. Dijkman, M. La Rosa and H.A. Reijers, Editorial: Managing large collections of business process models-current techniques and challenges, CI 63(2) (2012), 91–97.
[19] 
D.R. dos Santos, S. Ranise, L. Compagna and S.E. Ponta, Assisting the deployment of security-sensitive workflows by finding execution scenarios, in: Proc. of DBSec, Springer, 2015.
[20] 
H. Huang, F. Shang, J. Liu and H. Du, Handling least privilege problem and role mining in rbac, Journal of Combinatorial Optimization 30(1) (2013), 63–86. doi:10.1007/s10878-013-9633-9.
[21] 
M. Kohler and A. Schaad, Avoiding policy-based deadlocks in business processes, in: Proc. of ARES, IEEE, 2008.
[22] 
A. Koschmider, M. Fellmann, A. Schoknecht and A. Oberweis, Analysis of process model reuse: Where are we now, where should we go from here?, Decision Support Systems 66(0) (2014), 9–19. doi:10.1016/j.dss.2014.05.012.
[23] 
N. Li and J.C. Mitchell, Datalog with constraints: A foundation for trust management languages, in: Proc. of PADL, 2003.
[24] 
N. Li, Q. Wang and M. Tripunitara, Resiliency policies in access control, TISSEC 12(4) (2009), 20:1–20:34. doi:10.1145/1513601.1513602.
[25] 
H. Lu, Y. Hong, Y. Yang, Y. Fang and L. Duan, Dynamic workflow adjustment with security constraints, in: Proc. of DBSec, Springer, 2014.
[26] 
J.C. Mace, C. Morisset and A. van Moorsel, Quantitative workflow resiliency, in: Proc. of ESORICS, Springer, 2014.
[27] 
J.C. Mace, C. Morisset and A. van Moorsel, Modelling user availability in workflow resiliency analysis, in: Proc. of HotSoS, ACM, 2015.
[28] 
J.C. Mace, C. Morisset and A. van Moorsel, Proc. of qest, in: Impact of Policy Design on Workflow Resiliency Computation Time, Springer, 2015.
[29] 
J.C. Mace, C. Morisset and A. van Moorsel, Resiliency variance in workflows with choice, in: Proc. of SERENE, Springer, 2015.
[30] 
OMG, Business Process Model and Notation (BPMN), version 2.0, Technical report, Object Management Group, 2011.
[31] 
R. Sandhu, V. Bhamidipati and Q. Munawer, The arbac97 model for role-based administration of roles, TISSEC 2(1) (1999), 105–135. doi:10.1145/300830.300839.
[32] 
R. Sandhu, E. Coyne, H. Feinstein and C. Youmann, Role-based access control models, IEEE Computer 2(29) (1996), 38–47. doi:10.1109/2.485845.
[33] 
A.U. Shankar, An introduction to assertional reasoning for concurrent systems, ACM Comput. Surv. 25(3) (1993), 225–262. doi:10.1145/158439.158441.
[34] 
J.A. Solworth, Approvability, in: Proc. of ASIACCS, ACM, 2006.
[35] 
W.M.P. van der Aalst, Business process management: A comprehensive survey, ISRN Software Engineering 2013 (2013).
[36] 
Q. Wang and N. Li, Satisfiability and resiliency in workflow authorization systems, TISSEC 13 (2010), 40:1–40:35.
[37] 
M. Weske, Business Process Management: Concepts, Languages, Architectures, Springer, New York, 2007.
[38] 
I.R.P. Yang, X. Xie and S. Lu, Satisfiability analysis of workflows with control-flow patterns and authorization constraints, IEEE TSC 99 (2013).
[39] 
N.H. Zaaboub, L. Makni and H.B. Abdallah, Literature review of reuse in business process modeling, Software & Systems Modeling 13(3) (2014), 975–989. doi:10.1007/s10270-012-0286-4.

Full article PDF XML
Full article PDF XML

Copyright
IOS Press and the authors. All rights reserved

Keywords
Workflow satisfiability run-time monitor business process

Metrics
since February 2017
3

Article info
views

0

Full article
views

0

PDF
downloads

0

XML
downloads


Share


RSS