Automatically finding execution scenarios to deploy security-sensitive workflows

Article type: Research Article

Authors: dos Santos, Daniel Ricardo^{a; b; c; *} | Ranise, Silvio^a | Compagna, Luca^b | Ponta, Serena Elisa^b

Affiliations: [a] Fondazione Bruno Kessler, Italy | [b] SAP Labs France, France | [c] University of Trento, Italy

Correspondence: [*] Corresponding author. E-mail: [email protected].

Abstract: We introduce a new class of analysis problems, called Scenario Finding Problems (SFPs), for security-sensitive business processes that – besides execution constraints on tasks – define access control policies (constraining which users can execute which tasks) and authorization constraints (such as Separation of Duty). The solutions to SFPs are concrete execution scenarios that assist customers in the reuse and deployment of security-sensitive workflows. We study the relationship of SFPs to well-known properties of security-sensitive processes such as Workflow Satisfiability and Resiliency together with their complexity. Finally, we present a symbolic approach to solving SFPs and describe our experience with a prototype implementation on real-world business process models taken from an on-line library.

Keywords: Workflow satisfiability, run-time monitor, business process

DOI: 10.3233/JCS-16894

Journal: Journal of Computer Security, vol. 25, no. 3, pp. 255-282, 2017