Valued Workflow Satisfiability Problem

0.22 MB·English

by  Jason Crampton

Valued Workflow Satisfiability Problem
Jason Crampton Gregory Z. Gutin Daniel Karapetyan
InformationSecurityGroup DepartmentofComputer ASAPResearchGroup
RoyalHolloway,Universityof Science SchoolofComputerScience
London RoyalHolloway,Universityof UniversityofNottingham
Egham,Surrey London Nottingham
UKTW200EX Egham,Surrey UKNG81BB
[e-mail] UKTW200EX [e-mail]
[e-mail]
5
1
0 ABSTRACT 1. INTRODUCTION
2
A workflow is a collection of steps that must be executed It is increasingly common for organisations to comput-

n in some specific order to achieve an objective. A comput- erise their business and management processes. The co-
a erisedworkflowmanagementsystemmayenforceauthorisa- ordinationofthetasksorstepsthatcompriseacomputerised
J tionpoliciesandconstraints,therebyrestrictingwhichusers businessprocessismanagedbyaworkflowmanagementsys-

0 canperformparticularstepsinaworkflow. Theexistenceof tem (or business process management system). A workflow
3 policiesandconstraintsmaymeanthataworkflowisunsat- isdefinedbythestepsinabusinessprocessandtheorderin
isfiable, in the sense that it is impossible to find an autho- which those steps should be performed. A workflow is exe-

] rised user for each step in the workflow and satisfy all con- cutedmultipletimes,eachexecutionbeingcalledaworkflow
S
straints. In this paper, we consider the problem of finding instance. Typically,theexecutionofeachstepinaworkflow
D
the“least bad”assignment ofuserstoworkflowstepsbyas- instance will be triggered by a human user, or a software
. signingaweight toeachpolicy andconstraint violation. To agent acting under the control of a human user. As in all
s
c thisend,weintroduceaframeworkforassociatingcostswith multi-user systems, some form of access control, typically
[ theviolationofworkflowpoliciesandconstraintsanddefine specified in the form of policies and constraints, should be

the valued workflow satisfiability problem (Valued WSP), enforcedontheexecutionofworkflowsteps,therebyrestrict-
1
whose solution is an assignment of steps to users of mini- ing the execution of each step to some authorised subset of
v
mum cost. We establish the computational complexity of theuser population.
4
Valued WSP with user-independent constraints and show
1
that it is fixed-parameter tractable. We then describe an Policies typically specify theworkflow stepsfor which users
8
algorithm for solving Valued WSP with user-independent areauthorised,whatBasinetal.callhistory-independent au-
7
constraints and evaluate its performance, comparing it to thorisations [2]. Constraints restrict which groups of users
0
that of an off-the-shelf mixed integer programming pack- can perform sets of steps. It may be that a user, while
.
1 age. authorised by the policy to perform a particular step s, is
0 prevented (by one or more constraints) from executing s in
5 Categories andSubject Descriptors a specific workflow instance because particular users have
1
performed other steps in the workflow (hence the alterna-
: D4.6[Operating Systems]: SecurityandProtection—Ac-
v cess controls; F2.2 [Analysis of Algorithms and Prob- tivenameofhistory-dependent authorizations[2]). Thecon-
Xi lem Complexity]: Nonnumerical Algorithms and Prob- cept of a Chinese wall, for example, limits the set of steps
that any one user can perform [3], as does separation-of-
lems; H2.0 [Database Management]: General—Security,
r duty,whichisacentralpartoftherole-basedaccesscontrol
integrity and protection
a
model [1]. We note that policies are, in some sense, discre-
tionary,astheyaredefinedbytheworkflowadministratorin
General Terms
thecontextofagivensetofusers. However,constraintsmay
Algorithms, Security,Theory be mandatory (and independentof theuser population), in
thattheymayencodestatutoryrequirementsgoverningpri-
Keywords vacy or separation-of-concerns or high-level organisational
workflow satisfiability, parameterized complexity, valued requirements.
workflow satisfiability problem
It is well known that a workflow specification may be“un-
satisfiable”inthesensethatthecombinationofpoliciesand
constraints means that there is no way of allocating au-
thorised users to workflow steps without violating at least
one constraint. The workflow satisfiability problem is NP-
hard [23] although relatively efficient algorithms have been
developed on the assumption that the number of workflow
steps is much smaller than the number of users that may
perform stepsin theworkflow[7,11,17,23]. Ofcourse,the
1
objectives of the business process associated with a work- 2.1 WSP
flow specification can never be achieved if the specification A directed acyclic graph G = (V,E) is defined by a set of
is unsatisfiable. Hence, it is interesting to consider an ex- nodes V and a set of edges E ⊆ V × V. The reflexive,
tended version of the workflow satisfiability problem that transitiveclosure of a directed acyclic graph (DAG)defines
seeksthe“best”allocationofuserstostepsintheeventthat a partial order, where v 6 w if and only if there is a path
thespecification is unsatisfiable. from v to w in G. We may write v > w whenever w 6 v.
Wemay also write v<w wheneverv6w and v6=w.
Accordingly,inthispaperwestudythevalued workflowsat-
isfiabilityproblem(ValuedWSP).Informally,weassociate
constraint and authorisation violations with a cost, which Definition 1. A workflow specification is defined by a
may be regarded as an estimate of the risk associated with directed, acyclic graph G=(S,E), where S is a set of steps
allowing those violations. We then compute an assignment andE ⊆S×S. Givenaworkflow specification (S,E)anda
of users to steps having minimal cost, this cost being zero set of users U, an authorisation policy for a workflow spec-
when the workflow is satisfiable. In a sense, our work is ification is a relation A⊆S×U. A workflowauthorisation
related to recent work on risk-aware access control [4, 5, schema is a tuple (G,U,A), where G=(S,E) is a workflow
12, 19], which seeks to compute the risk of allowing a user specification and A is an authorisation policy.
to perform an action, rather than simply computing an al-
low/deny decision, andensurethatcumulativerisk remains
withincertainlimits. However,unlikerelatedwork,wefocus A workflow specification describes a sequence of steps and
oncomputinguser-stepassignmentsofminimalcost,rather theorderin which they mustbe performed when thework-
than access control decisions. flow is executed, each such execution being called a work-
flow instance.1 User u is authorised to perform step s only
Our main contributions are: to define Valued WSP and if (s,u) ∈ A.2 We assume that for every step s ∈ S there
determine its complexity; to prove that Valued WSP exists some user u∈ U such that (s,u) ∈ A (otherwise the
is fixed-parameter tractable for weighted user-independent workflow is trivially unsatisfiable).
constraints; todevelopanalgorithm tosolveValued WSP
with user-independent constraints; to provide a compre-
hensive experimental evaluation of our algorithm; and to Definition 2. Let ((S,E),U,A) be a workflow authori-
demonstrate that the performance of our algorithm com- sation schema. A plan is a function π : T → U, where
paresveryfavourablywithanapproachthatusesthemixed T ⊆S. A plan π is complete if T =S.
integerprogrammingsolverCPLEX.Ourexperimentaleval-
uation shows our algorithm enjoys a substantial advantage
over CPLEX as the number of steps grows, with our algo- Definition 3. A workflow constraint has the form
rithm being able to deal far better with problem instances (T,Θ), where T ⊆ S and Θ is a family of functions with
containing more than 30 steps. Moreover, our algorithm is domain T and range U. T is the scope of the constraint
far better at solving instances that are unsatisfiable – pre- (T,Θ). A constrained workflow authorization schema is a
cisely those instances for which Valued WSPis relevant. pair ((S,E),U,A,C), where ((S,E),U,A) is a workflow au-
thorization schema and C is a set of workflow constraints.
In the next section, we define Valued WSP, having re-
viewed relevant concepts from the literature, including the
workflow satisfiability problem and user-independent con-
Informally,aworkflowconstraint(T,Θ)limitstheusersthat
straints. In Section 3, we prove that Valued WSP is
areallowedtoperformasetofstepsT inanygiveninstance
fixed-parameter tractable for user-independent constraints
of theworkflow. In particular, Θ identifies authorised (par-
and describe an algorithm based on the concept of a pat-
tial) assigments of users to workflow steps in T. More for-
tern, whichis, informally, acompact representationof aset mally, let π : S′ → U, where S′ ⊆ S, be a plan. Given
of similar plans for a user-independent constraint. In Sec- T ⊆ S′, we write π|T to denote the function π restricted
tion 4, we present our experimental results. This section
to domain T; that is π|T(s) = π(s) for all s ∈ T (and is
also includes a method of representing Valued WSP as a undefined otherwise). Then we say π : S′ → U satisfies a
mixedintegerprogrammingproblem,whichmaybeofusein workflow constraint (T,Θ) if T 6⊆S′ or π|T ∈Θ.
subsequent research. We conclude the paper with a discus-
sion of related work, a summary of contributions and some 1In this paper, the ordering on the steps is not consid-
suggestions for future work. ered. Priorworkhasshownthattheorderingisirrelevantto
the question of satisfiability subject to certain assumptions
abouttheconstraints[11],assumptionsthataresatisfiedby
theconstraints considered in this paper.
2. BACKGROUNDANDPROBLEM
2Inpractice,thesetofauthorisedstep-userpairs,A,willnot
STATEMENT be definedexplicitly. Instead, A will be inferred from other
We first briefly summarise relevant concepts from the lit- access control data structures. In particular, R2BAC – the
erature, including workflow authorisation schema, workflow role-and-relation-based access control model of Wang and
Li[23]–introducesasetofrolesR,auser-rolerelationUR⊆
constraints and the workflow satisfiability problem (WSP).
U×R andarole-step relation SA⊆R×S from which it is
We then explain how a constrained workflow authorisation
possible to derive the steps for which users are authorised.
schemacanbeextendedtoassigncoststoplansthatdonot Forallcommonaccesscontrolpolicies(includingR2BAC),it
satisfy the schema’s policy and constraints. We conclude is straightforward to derive A. We prefer to use A in order
this section with aformal definition of Valued WSP. to simplify theexposition.
2
Definition 4. Given a constrained workflow authoriza- Graph k-Colorability to WSP with separation-of-duty
tion schema ((S,E),U,A,C), we say a plan π : S → U is constraints [23, Lemma 3].
valid if it satisfies every constraint in C and, for all t∈S,
(t,π(t))∈A. The importance of findingan efficient algorithm for solving
WSPledWangandLitolookattheproblemfromtheper-
spectiveofparameterisedcomplexity. Supposewehaveanal-
Inpractice,wedonotdefineconstraintsbyenumeratingall gorithmthatsolvesanNP-hardproblemintimeO(f(k)nd),
possible elements of Θ. Instead, we definedifferent families where n denotes the size of the input to the problem, k is
of constraints that have“compact”descriptions. Thus, for some (small) parameter of the problem, f is some function
example, we might define the family of simple separation- in k only, and d is some constant (independent of k and
of-duty constraints, each of which is represented by a set n). Thenwesaythealgorithmisafixed-parameter tractable
{t1,t2},theconstraintbeingsatisfiedprovidedt1 andt2 are (FPT) algorithm. Ifaproblemcan besolved usingan FPT
assigned todifferent users. algorithm then we say that it is an FPT problem and that
it belongs to theclass FPT [13, 20].
A constraint (T,Θ) is said to be user-independent if, for
every θ ∈ Θ and every permutation φ : U → U, φ◦θ ∈ Θ, Wang and Li observed that fixed-parameteralgorithmics is
where anappropriatewaytostudytheproblem,becausethenum-
φ◦θ:T →U and (φ◦θ)(s)d=ef φ(θ(s)). ber k of steps is usually small and often much smaller than
the number n of users.3 Wang and Li [23] proved that,
Simpleseparation-of-dutyconstraintsareuser-independent, in general, WSP is W[1]-hard and thus is highly unlikely
and it appears most constraints that are useful in prac- to admit an FPT algorithm. However, WSP is FPT if we
tice are user-independent [7]. In particular, cardinal- consider only separation-of-duty and binding-of-duty con-
ity constraints and binding-of-duty constraints are user- straints [23]. Henceforth, we consider special families of
independent. In this paper, we restrict our experimental constraints, but allow arbitrary authorisations. Crampton
evaluation to two particular types of user-independentcon- et al.[11]obtained significantlyfaster FPT algorithms that
straints (in addition to separation-of-dutyconstraints): were applicable to“regular”constraints, thereby including
thecasesshowntobeFPTbyWangandLi. Subsequentre-
searchhasdemonstratedtheexistenceofFPTalgorithmsfor
• an at-least-r counting constraint has the form (T,r), WSPinthepresenceofotherconstrainttypes[9,10]. Cohen
wherer6|T|,andissatisfiedprovidedatleastrusers etal.[7]introducedtheclassofuser-independentconstraints
are assigned tothesteps in T; andshowedthatWSPremainsFPTifonlyuser-independent
constraintsareincluded. Notethateveryregularconstraint
• an at-most-r counting constraint has the form (T,r), is user-independent and all the constraints defined in the
wherer6|T|,andissatisfiedprovidedatmostrusers ANSI RBAC standard [1] are user-independent. Results of
are assigned tothesteps in T. Cohen et al. [7] have led to algorithms which significantly
outperform the widely used SAT-solver SAT4J on difficult
instancesofWSPwithuser-independentconstraints[6,17].
It is important to stress that our approach works for any
user-independent constraints. We chose to use counting
constraints because such constraints have been widely con- 2.3 ValuedWSP
sidered in the literature (often known as cardinality con-
Therehasbeenconsiderableinterestinrecentyearsinmak-
straints). Moreover, counting constraints can be encoded
ingthespecification andenforcement of accesscontrolpoli-
usingmixedintegerprogramming,sowecanuseoff-the-shelf
cies more flexible. Naturally, it is essential to continue to
solvers tosolveWSPand tocomparewith theperformance
enforce effectiveaccess control policies. Equally,it is recog-
of ourbespokealgorithms.
nised that there may well be situations where a simple“al-
low”or“deny”decisionforanaccessrequestmaynotbeap-
We now introduce the workflow satisfiability problem, as
propriate. Itmaybe,forexample,thattherisksofrefusing
defined byWangand Li [23].
an unauthorised request are less significant than the bene-
fitsofallowingit. Oneobviousexampleoccursinhealthcare
systems, where the denial of an access request in an emer-
Workflow Satisfiability Problem (WSP) gency situation could lead to loss of life. Hence, there has
Input: A constrained workflow authorisation schema been increasing interest in context-aware policies, such as
((S,E),U,A,C) “break-the-glass”,whichallowdifferentresponsestorequests
Output: A valid π:S →U or an answer that there in different situations. Risk-aware access control is another
exists no valid plan promising line of research that seeks to quantify the risk of
allowing a request, where a decision of“0”might represent
an unequivocal“deny”and“1”an unequivocal“allow”, with
2.2 Fixed-Parameter Tractability ofWSP
decisions ofintermediatevaluesrepresentingdifferentlevels
A na¨ıve approach to solving WSP would consider ev-
of risk.
ery possible assignment of users to steps in the workflow.
There are nk such assignments if there are n users and k 3The SMV loan origination workflow studied by Schaad et
steps, so an algorithm of this form would have complexity al.,forexample,has13stepsandidentifiesfiveroles[21]. It
O(mnk), where m is the number of constraints. Moreover, isgenerallyassumedthatthenumberofusersissignificantly
Wang and Li showed that WSP is NP-hard, by reducing greater than thenumberof roles.
3
Similar considerations arise very naturally when we con- of steps that are assigned to unauthorised users increases.
sider workflows. In particular, we may specify authoriza- More formally,
tion policies and constraints that mean a workflow specifi-
cation is unsatisfiable. Clearly, this is undesirable from a =0 if (π(t),t)∈A for all t,
wA(π)
businessperspective,sincethebusinessobjectiveassociated (>0 otherwise
withtheworkflowcannotbeachieved. Therearetwopossi-
is theauthorisation weight of π.
blewaysofdealingwithanunsatisfiableworkflowspecifica-
tion:(i) modify the authorization policy and/or constraints;
(ii)findthe“leastbad”completeplan. PriorworkbyBasin, The definition of wA can be arbitrarily fine-grained. We
could,forexample,associateaweightω(t,u)witheverypair
BurriandKarjothconsideredtheformerapproach[2]. They
(t,u),whereazeroweight indicatesthatuisauthorised for
restricted their attention to modification of the authorisa-
t, and define
tion policy, what they called administrable authorizations.
They assigned costs tomodifying differentaspects of a pol-
wA(π)= ω(t,π(t)).
icy and then computed a strategy to modify the policy of
minimal cost. Xt∈T
Oneparticularlysimpleinstantiationofthisideaistodefine
a single weight ω > 0 to be associated with every policy
Weadopt adifferent approach and consider minimising the
cost of“breaking”the policies and/or constraints. (We will violation. Inthiscase,wA(π)=aω,whereaisthenumberof
compare our approach to Basin et al. in the related work stepsthatareassignedtounauthorisedusers. Alternatively,
we might distinguish between different types of users, so
section.) Informally,givenaworkflowspecification,foreach
that, for example, assigning steps to external contractors
plan π, we define the total cost or weight associated with
the plan w(π). The problem, then, is to find the complete is associated with a higher weight ωe than the weight ωi
associated with assigning steps to (internal) unauthorised
plan with minimum total cost.
staff members.
More formally, let ((S,E),U,A,C) be a constrained work-
We may now define the valued workflow satisfiability prob-
flow authorization schema. Let Π denote the set of all pos-
lem,whichwillbethesubjectoftheremainderofthepaper.
sible plans from S to U. Then, for each c∈C, we define a
weight function wc :Π→Z,where
=0 if π satisfies c, Valued WSP
wc(π)(>0 otherwise. Input: A constrained workflow authorisation schema
((S,E),U,A,C) with weights for constraints
The pair (c,wc) is a weighted constraint. and authorisations, as above.
Output: A plan π:S →U that minimises
The intuition is that wc(π) represents the extent to which w(π)=wC(π)+wA(π).
π violates c. Consider, for example, an at-most-r counting
constraint (T,r). Then wc(π) depends only on the number
of users assigned to the steps in T (and the penalty should Before proceeding further, however, we introduce a weight
increaseasthenumberofusersincreases). Letπ(T)denote function that is more fine-grained than those considered
the set of users assigned to steps in T. Then wc(π) = 0 if above, and the one that we shall use in the remainder of
|π(T)| 6 r; for plans π and π′, we have wc(π) = wc(π′) if this paper. Specifically, for each user u and each subset T
|π(T)| = |π(T′)|; and 0 < wc(π) ≤ wc(π′) if r < |π(T)| ≤ of S, we definea weight ω(T,u)∈Z,where
|π′(T)|. Similarly, for an at-least-r constraint c with scope
T, we would have wc(π) = 0 if |π(T)| > r; for plans π =0 if (u,t)∈A for all t∈T,
and π′, we have wc(π) = wc(π′) if |π(T)| = |π(T)|; and ω(T,u)(>0 otherwise.
0<wc(π)≤wc(π′) if |π(T)|≥|π′(T)|>0.
Wecallω:2S×U the(weighted)set-authorisation function.
Then we define Vacuously, we have ω(∅,u) = 0 for all u ∈ U. We write
π−1(u) to denote the set of steps to which u is assigned by
wC(π)= wc(π),
plan π. Then we define
c∈C
X
whichwecalltheconstraintweight ofπ. NotethatwC(π)= wA(π)= ω(π−1(u),u).
0ifandonlyifπsatisfiesallconstraintsinC. Notealsothat u∈U
X
wC(π)neednotbedefinedtobethelinearsum: wC(π)may Clearly, this form of authorisation weight satisfies the re-
be defined to be an arbitrary function of the tuple (wc(π): quired criteria.
c ∈ C) and Theorem 1 below would still hold. However,
we will not usethisgeneralisation in thispaper,butsimply
WebasewAonweightsoftheformω(T,u)because,inaddi-
remark that it is possible, if needed.
tion to allowing us to specify weights for every pair (t,u) if
required,itallowsustoexpressmorecomplex(“non-linear”)
We next introduce a function wA :Π→Z, which assigns a costs on plans. For example:
cost for each plan with respect to the authorisation policy.
Theintuitionisthataplaninwhicheveryuserisauthorised
for the steps to which she is assigned has zero cost and the 1. We can introduce a large penalty ω(T,u), effectively
costofaplanthatviolatesthepolicyincreasesasthenumber sayingweprefernottoinvolveuinstepsinT. (Weuse
4
weights like this in our experimental work, described following theorem, which uses weighted set-authorisation.
in Section 4.) We assume(i) that the weight of each assignment can be
computed in time polynomial in the numberof steps, users
2. Wecandefinealimitℓonthenumberofstepsthatcan
and constraints (denoted k, n and m, respectively); (ii) we
beexecutedbyu,bysettingalargepenaltyω(T,u)for
can determine whether a plan satisfies a constraint in time
all T of cardinality greater than ℓ.
polynomial in thenumberof stepsand users.
3. We can attempt to minimise the number of involved
users bygiving a small penalty for assigning auser to
Theorem 1. Valued WSP in which all constraints are
atleastonestep. Thisissimilartoitem1above,albeit user-independentcanbesolvedintime2klogk(k+n+m)O(1).
with a different goal.
Thus, Valued WSP with user-independent constraints is
4. The weights associated with the same user execut- FPT.
ing different steps may not increase linearly. Once a
user has performed one particular unauthorized step, Proof. Forapositiveintegerx,let [x]={1,...,x}.Re-
theadditionalcostofexecutingarelated unauthorized call that for equivalent complete plans π and π′, we have
step maybereduced,while theadditionalcost of exe- wC(π) = wC(π′). However, wA(π) = u∈UwA(π−1(u),u)
cutinganunrelated unauthorizedstepmaybethesame is, in general, different from wA(π′) and so we must com-
as the original cost. Our formulation enables us to putetheminimumvalueofwA(π)amonPgallequivalentcom-
model this kindof situation. plete plans π. To do so efficiently, for a complete plan π,
5. Wecanimplementseparation-of-dutyonaper-userba- we first construct a weighted complete bipartite graph Gπ
with partite sets [p] and U, where p = |P(π)| as follows.
sis, which is not possible with user-independent con-
straints. In particular, it may be acceptable for u to Let P(π) = {T1,...,Tp}. The weight of an edge {q,u} is
1
ω(s,u).
perform steps s1 and s2, but not u2, in which case s∈Tq
ω({s1,s2},u1) would be small, while ω({s1,s2},u2) P
would belarge. NowobservethatGπ′ =Gπforeverypairπ,π′ofequivalent
complete plans and that wA(π) equals the weight of the
corresponding matching of Gπ covering all vertices of [p].
The next claim is an important observation following di-
Hence,itsufficestofindsuchamatchingofGπ ofminimum
rectly from thedefinitionsabove.
weight,whichcanbedonebytheHungarianmethod[18]in
time O(n3).
Proposition 1. The optimal weight of an instance of
Valued WSP equals zero if and only if the corresponding Observethatthenumberofpartitionsoftheset[k]intonon-
WSP instance is satisfiable. emptysubsets,calledtheBellnumberBk,issmallerthank!
andtherearealgorithmsofrunningtimeO(Bk)=O(2klogk)
3. SOLVING VALUED WSP WITH USER- to generate all partitions of [k] [14]. Thus, we can generate
allpatternsintimeO(2klogk). Foreachofthemwecompute
INDEPENDENT CONSTRAINTS
the corresponding complete plan of minimum weight, and,
In Section 3.1 we introduce the notion of weighted user- among allsuch plans,we choosetheoneof smallest weight.
independent constraints and prove that Valued WSP The total runningtimeis O(2klogk(k+n+m)O(1)).
with only user-independent constraints is fixed-parameter
tractable (FPT). In Section 3.2, we describe an FPT algo-
rithm to solve Valued WSP with user-independent con- Cohen et al. proved [7] that WSP with user-independent
straints. constraintscannotbesolvedintime2o(klogk)(k+n+m)O(1),
unless the widely believed Exponential Time Hypothesis4
3.1 Weighted User-Independent Constraints fails. ThisandProposition1implythattheFPTalgorithm
of Theorem 1 is optimal, in asense.
and Patterns
A weighted constraint c is called user-independent if, for 3.2 Pattern Branch andBound
every permutation θ of U, wC(π) = wC(θ ◦π). Thus, a
Wepresentabranch-and-boundalgorithm(Algorithm1)for
weighted user-independent constraint does not distinguish
the Valued WSP. This algorithm is inspired by the Pat-
between users. Any (weighted) counting constraint for
tern Backtracking algorithm for the WSP [17]. However,
which the weight of plan π is defined in terms of the cardi-
the original algorithm solves a decision problem, whereas
nality of theimage of π is user-independent.
the Valued WSP is an optimisation problem. Thus our
Given a plan π : S′ → U, where S′ ⊆ S, the pattern P(π) algorithm for Valued WSP requires a completely differ-
of π is the partition {π−1(u) : u ∈ U, π−1(u) 6= ∅} of ent algorithmic framework. We call our algorithm for the
Valued WSP Pattern Branch and Bound (PBB). Given a
S′ into non-empty sets. We say that two plans π and π′
pattern P, we will write T(P) = p to denote the set
are equivalent if they have the same pattern. If all con- p∈P
T ⊆S on which P is thepartition.
straints are user-independent and π and π′ are equivalent, S
then wC(π) = wC(π′). A pattern is said to be complete if
S′ =S. ThegeneralideaofthealgorithmfollowstheproofofTheo-
rem 1. Thealgorithm explores thespace of patterns with a
Generalising the corresponding result for WSP with user- 4The ExponentialTime Hypothesisclaims thereis noalgo-
independent constraints [7, Theorem 2], we can prove the rithmofrunningtimeO∗(2o(n))for3SATonnvariables[16].
5
Algorithm 1: Entrypoint of thePBB algorithm. beginning of the search (line 2 of Algorithm 1). In a sim-
ple implementation, the global lower bound λ(W) could be
input : Valued WSPinstance W
a constant function λ(W) = 0; that would terminate the
output: The optimal complete plan for W
algorithm as soon as acomplete plan satisfying all thecon-
1 λ←λ(W),where λ(W)is the global lower bound;
straintsandauthorisationsisfound. Theheuristicalgorithm
2 π←H(W),where H(W)is aValued WSPheuristic;
can beas simple as a trivial plan assigning some user to all
3 return explore(∅,π,λ);
thesteps S.
In our implementation, however, we translate the Valued
Algorithm 2: Recursive procedureexplore(P,π∗,λ) of the
WSP instance W into WSP instances and solve them to
PBB algorithm.
obtain better global lower bound and upper bound. Let
input : Node P of thesearch tree; best plan π∗ found so WSP(W,x) be a WSP instance obtained from W by elimi-
far; the global lower boundλ nating all the constraints and authorisations with penalties
output: Thebest plan found after exploring thisbranchof belowxandconvertingtherestoftheconstraintsandautho-
search risations into hard constraints. By solving WSP(W,x) we
1 if P is a complete pattern then establish eithertheglobal lowerboundortheupperbound.
2 Let π′ bean optimal plan with pattern P; If WSP(W,x) is unsatisfiable, we conclude that there ex-
3 π′′←argminπ∈{π′,π∗}w(π); ists no complete plan π such that w(π) < x and, hence,
4 else λ(W)=x. Otherwise, the plan valid in WSP(W,x) can be
5 π′′←π∗; used for an upper bound in W. We start from solving the
6 Select s∈S\T(P)maximising I(P,s); WSP(W,1) and, if it turnsout to be unsatisfiable, we solve
7 forall the extensions P′ of P with step s do theWSP(W,M),whereM isalargeenoughnumber,which
8 if L(P′)<w(π′′) and w(π′′)>λ then usually gives us a good upper bound as it rules out plans
9 Let π′←explore(P′,π′′,λ); that break highly-penalised constraints.
10 π′′←argminπ∈{π′,π′′}w(π);
Theorderinwhichpatternsareextended(astepatatime)
11 return π′′; makesnodifferencetotheworst-casetimecomplexityofthe
algorithmbutiscrucialtoitsperformanceinpractice[17]. It
isdefinedbythe‘importance’functionI(P,s),theintention
beingto focus on themost important stepsas early as pos-
depth-firstsearch andforeachcompletepatternP seeksan
sible to quickly prune fruitless branches of the search. The
optimal plan π suchthat P(π)=P (recall thatsuch aplan
importanceofastepmostlydependsontheconstraintsthat
can be found efficiently). Each node of the search tree is a
include the step in their respective scopes. For example, if
pattern, with the root being an empty pattern and leaves
a step is involved in several separation-of-duty constraints,
being complete patterns. In each non-leaf node P, the al-
addingit tothepatternmaysignificantlyreducethesearch
gorithm selects a step s ∈ S such that s 6∈ T(P) (line 6 of
spaceandpossiblyresultinincreasedpenaltiesforsomeat-
Algorithm 2), and generates one child node for each possi-
most constraints. Another example is if most of the steps
bilitytoextendP withs(line10). ByextensionsofP with
of some constraint’s scope are assigned, and adding the re-
stepswemeanpatternsP′ obtainedfromP byaddingsto
maining steps to the pattern may have a severe effect on
one of the subsets p∈P or adding a new subset {s} to the
the penalty for that constraint. The ‘importance’ metric is
partition; hence, thereare |P|+1 extensions of P.
context-dependent,i.e.theorderofstepsneedstobedeter-
mined dynamically in each branchof thesearch tree.
Likeanybranch-and-boundalgorithm,PBButilisesalower
bound L(P) for pruning branches. The lower bound L(P)
The ‘importance’ function I(P,s) is a heuristic expression
in a nodeP is computed as follows:
which we parametrised andoptimised byan automated pa-
rameter tuningmethod. Ourfunction I(P,s) takes into ac-
L(P)= Lc(P)+ minω(p,u),
u∈U countthenumberand typesoftheconstraintsinwhich the
c∈C p∈P
X X step is involved. In addition, it accountsfor theconstraints
where Lc(P) is the lower bound of wc(π), where π is an with incomplete scopes. Finally, we check intersections of
extension of a plan with pattern P. The implementation ‘conflicting’ constraints such as at-most and not-equals or
of Lc(P) depends on the constraint type. For example, for at-most and at-least.
a counting constraint c with the scope T and weight func-
tion wc(π)=ωc(|π(T)|), the lower bound can be computed As shown in the proof of Theorem 1, finding the optimal
as Lc(P) = l(q,a), where q = |{p ∈ P : p∩T 6= ∅}|, assignment of users given a fixed pattern can be done in
a=|T ∩T(P)| and l(q,a) is the following recursive func- O(n3)time(ifcomputingwC(π)takesO(n3)timeandcom-
tion: puting ω(T,u) takes O(n3/k) time). Each non-leaf node of
the search tree has at least two child nodes and, hence, the
l(q,a)= ωc(q) if a=|T|, sizeofthesearchtreeiswithinO(Bk). Thentheworstcase
(min{l(q,a+1),l(q+1,a+1)} otherwise. time complexity of thePBB algorithm is O(Bkn3).
Withtheexceptionofthe‘stepimportance’functionI(P,s),
Otherspeed-upsimplementedinthePBBalgorithminclude
which is easy to adjust for any type of instances, and the
a global lower bound λ(W) (line 1 of Algorithm 1) and the
lower bound L(P), our algorithm is a generic solver for the
heuristicH(W)toobtainagoodupperboundfromthevery
6
user-independent Valued WSP. For example, it does not In order to use an MIP solver, we propose an efficient MIP
exploitthespecificsofthecountingconstraintswhichcould formulation of the Valued WSP. Note that the MIP for-
beusedtopreprocessprobleminstances[7]. Thisshowsthat mulation is specific to the particular constraints present in
our approach is generic, easy to implement and its perfor- theinstances, unlikethePBB algorithm. Inthissection we
mance can be further improved by implementing instance- describe an MIP formulation for the instances described in
specific speed-ups. Section 4.1.
4. EXPERIMENTAL RESULTS Let C = C≤ ∪C≥, where C≤ is the set of at-most-r con-
straints and C is the set of at-least-r constraints. (Note
The pseudo-Boolean SAT solver SAT4J has been used to ≥
that not-equals constraints can be modelled as at-least-2
solve the WSP [23]. Recent work has demonstrated that a
constraintswiththescopeoftwosteps.) Foreachconstraint
bespoke pattern-based algorithm can outperform SAT4J in
solving WSP [6, 17]. Integer linear programming has been c ∈ C we are given its scope Tc ⊆ S, the minimum (maxi-
used by Basin et al. to solve the allocation existence prob- mum,respectively)numberrc ofusersthatcanbeassigned
to c∈C such that the at-most (at-least, respectively) con-
lem [2], which is related to Valued WSP. In this section,
we describe the experimental work on Valued WSP that straint c is satisfied and the penalty ωc(q) for assigning q
wehaveundertaken. Inparticular,wewillcomparetheper- distinct users to Tc (note that ωc(rc)=0).
formance of our PBB algorithm to that of the state-of-art
For each employee u ∈ U′ and each step s ∈ S \A(u) we
commercial MIP solver in our computational experiments
on Valued WSP. We first describe the problem instances are given an additive weight ωsu > 0 of assigning u to s,
which models the penalties for steps in both B(u) and S\
we used and how we represented Valued WSP as a mixed
(A(u)∪B(u)). For each consultant u ∈U′′ we are given a
integer programming (MIP) problem. We then present the
setofstepsA(u)⊆S,anyofwhichcanbeassignedtoufor
results of ourexperiments.
a penalty ωu >0, and a weight Ωu >0 for assigning a step
s∈S\A(u) to u.
4.1 Benchmark Instances
We use a pseudo-random instance generator to produce The complete plan in our formulation is defined by binary
benchmark instances. Our generator is an extension of an decision variables xsu, s ∈ S, u ∈ U. Variable xsu takes
existing instance generator for WSP [17]. The parameters value 1 if step s is assigned to user u and 0 otherwise. The
of the generator are the number k of steps in the instance, Valued WSPis thenencoded in (1)–(14):
the not-equals constraints density d in the range 0–100%,
the multiplier α for the numberof constraints and the seed |Tc|
valuefor initialisation ofthepseudo-randomnumbergener- minimise (ωc(q)−ωc(q−1))pcq
ator. The generator produces an instance with k steps and cX∈C≤q=Xrc+1
10k+10users: 10kemployeesU′and10externalconsultants rc−1
U′′. The penalty for assigning steps T ⊆S to an employee + (ωc(q)−ωc(q+1))pcq
u∈U′ is given by
cX∈C≥ Xq=1
ω(T,u)=|T ∩B|·10+|T \(A∪B)|·106, + ωsuxsu
where A ⊂S and B ⊂S are selected uniformly at random uX∈U′s∈SX\A(u)
from S,withA∩B=∅and|A|beingselecteduniformly at + ωuzu+ Ωu xsu (1)
raasnsidgonmingfrsotmep[s1,T⌈(⊆k−S4t)o/2a⌉n],eaxntedrn|Bal|c=on2s.uTlthanetpuen∈altUy′′foisr uX∈U′′ uX∈U′′ s∈SX\A(u)
given by subject to
0 if T =∅, xsu =1 for s∈S, (2)
ω(T,u)=20 if T 6=∅ and T ⊆A, uX∈U
110066··||TT \\AA||+20 iofthTer⊆wSise\,A, ycu− |Tc| pcq ≤rc for each c∈C≤, (3)
whereA⊂Sisselecteduniformlyatrandomhavingselected puXc∈qU−pc,q+q1=X≥rc+01for c∈C≤ and q=rc+1,...,|Tc|−1,
|A| uniformly at random from [1,⌈k/4⌉]. (4)
rc−1
Further, ⌊(dk(k−1)+1)/2⌋ distinct not-equals constraints
are produced uniformly at random, each with penalty 106 ycu+ pcq ≥rc for each c∈C≥, (5)
for assigning one user to both steps. Finally, αk at-most-3 uX∈U Xq=1
constraints and αk at-least-3 constraints aregenerated uni- pcq−pc,q+1≤0 for c∈C≥ and q=1,2,...,rc−2, (6)
formly at random. The scopes of all the at-most-3 and ycu−xsu≥0 for each c∈C≤, u∈U and s∈Tc, (7)
at-least-3 constraints are set to 5 steps. The at-least-3
penalties are defined as ωc(1) = 106, ωc(2) = 1, ωc(3) = ycu− xsu ≤0 for each c∈C≥ and u∈U, (8)
ωc(4) = ωc(5) = 0. The at-most-3 penalties are defined as sX∈Tc
ωc(1)=ωc(2)=ωc(3)=0, ωc(4)=5 and ωc(5)=10. zu−xsu≥0 for each u∈U′′ and s∈A(u), (9)
xsu ∈{0,1} for s∈S and u∈U, (10)
4.2 MixedIntegerProgrammingFormulation 0≤ycu ≤1 for c∈C and u∈U, (11)
7
pcq ∈{0,1} for c∈C≤ and q=rc+1,...,|Tc|, (12) theunsatisfiableinstanceswithmoderateweightsoftheop-
pcq ∈{0,1} for c∈C≥ and q=1,2,...,rc−1, (13) timal complete plans. A small weight w(π) indicates that
only a few minor exceptions are needed to implement the
0≤zu ≤1 for u∈U′′. (14) complete plan π. With such a plan, it is easy to identify
thebottleneckoftheproblemandrefineitoraccepttheex-
Inadditiontobinaryvariablesxsu,weintroducesomeother ceptionstotheconstraintsastheexceptionsarelikelytobe
variables. Binary variables ycu, c ∈ C, u ∈ U determine if mild. The wC(π) and wA(π) columns show that in most of
useruisassignedtosomestepsinthescopeTc ofconstraint thecases the authorisations were not broken. In fact, there
c. Since ycu for c∈C≤ is minimised and it is limited from were only a few highly-constrained instances in which the
below by binary expressions (7), its integrality constraint the optimal complete plans assigned some steps to consul-
can be waived. Since ycu for c ∈ C≥ is maximised and it tants, as thepenalty for doingthat is relatively high in our
is limited from above by binary expressions (8), its inte- instances.
grality constraint can also be waived. Similar logic applies
to zu, which indicates if the consultant u ∈ U′′ is assigned Thecomplexityoftheinstancesdependstoagreatextenton
any steps in B(u). Finally, we introduce the binary vari- the number of steps k and the parameters of the instances.
ables pcq for each c ∈ C and q ∈ N such that wc(q) > 0. Whilesmalllightly-constrainedinstancescanbeeasilytack-
These variables are responsible for the constraint penalties led by either of the solvers, other instances clearly require
and(withappropriatelimitationsimposedontheinstances, anefficientalgorithm. TheMIPsolversucceedswithallthe
as our instance generator does) the integrality of pcq and instancesofsizek=20butfailstosolvemanyofthelarger
constraints (4) and (6) can bewaived. instanceswithinanhour. ThePBBalgorithmdemonstrates
a much better performance, solving all theinstances of size
The objective function (1) is the weight of theplan defined uptok=30andthemajorityoftheinstancesofsizek=35.
by xsu, and thusour aim is tominimise it. It is worth noting that the running time of the MIP solver
canreach10minutesfork=20whilethePBBsolversolves
4.3 Experimental Results all such instanceswithin a fraction of a second.
Weconductedaseriesofcomputationalexperimentstotest
Exact algorithms for solving hard optimisation problems
the performance of the Valued WSP solution methods.
will, necessarily, take a long time to compute results for
Our test machine is powered by two Intel Xeon CPU’s E5-
certain instances. However, such an algorithm may find an
2630 v2 (2.6 GHz) and has 32 GB RAM installed. The
optimum or near-optimum result long before the whole so-
PBB algorithm isimplementedin C#,andtheMIPformu-
lutionspacehasbeensearchedandcanthusbeusedtocom-
lation is solved with CPLEX 12.6. In all our experiments,
pute a reasonable solution for instances that do not run to
each solver run is allocated exactly one physical CPU core.
completion. TheBestw(π)columninTable1clearlyshows
Each result is reported as an average over 100 runs for 100
that MIP is far less suitable than PBB for this purpose.
instances obtained by changing the random generator seed
value.
To establish the practical limit on the problem size that
each of the solvers can tackle within a reasonable time, we
Main computational results are reported in Table 1. The
conducted another experiment to determine the number of
columnsk,dandαindicatetheparametersoftheinstances.
instancesthatthetwosolverscouldsolvegivenatmost one
Foreachcombinationofparameters,100instancesweregen-
hour for each instance. Figure 1 shows the results of the
erated. The column “Sat.” reports the percentage of the
experiment. Each result is averaged over 100 experiments
instances that are satisfiable. The column w(π) shows the
for each instance.
average weight of the optimal complete plans. The other
columns compare the MIP-based solver to the PBB algo-
Figure 1a shows the performance of the methods on highly
rithm. Eachofthemisgivenonehourforeachinstance. The
constrained instances. Being given one hour, PBB solves
“Solved”columns show the percentage of instances success-
100% of the instances of size up to k = 32. In contrast,
fullysolvedwithintheonehourlimitbyeachofthesolvers.
MIPcan onlyreliably manage instancesfor k≤22, and for
The“Time, sec”columns show the average time taken by
k=32itfailstosolveanyinstancesatall. Figure1breports
each of the approaches. If at least one of the runs failed
the results of the same experiment but for less constrained
for a solver, a question mark is shown in the corresponding
instances. The results are broadly similar, with PBB solv-
cell of the table. The wC(π) and wA(π) columns show the ing all the instances of up to k = 44, whereas MIP fails
components of the weight corresponding to the constraints
for some instances when k > 24. This experiment shows
andtheauthorisationspenalties,respectively. Forthosepa-
that the PBB algorithm significantly extends the range of
rameters where at least one of the runs failed, we use the
solvable instancesof Valued WSP,something thatwill be
“Best w(π)”columns to to report the average weight of the
importantforlargereal-worldworkflowspecifications. Con-
best plan obtained by each of thesolvers.
sideringthattherunningtimeofeachofthemethodsgrows
exponentially with the size of the problem (see appendix),
For each k, Table 1 includes a range of instances starting
large instances of Valued WSP would require enormous
from lightly constrained instances, which aremostly satisfi-
computationalpowertobesolvedwithMIP,whilethePBB
able, to highly constrained instances, none of which is sat-
algorithmtacklesthemwithinminutesonaregularmachine.
isfiable. Naturally, the most interesting instances from the
perspective of Valued WSP are those that are unsatisfi-
able (since it is necessary to find an optimal plan of non-
zero weight for such instances). We are most interested in 5. RELATED WORK
8
Solved Time, sec wC(π) wA(π) Best w(π)
k d α Sat. w(π) PBB MIP PBB MIP PBB MIP PBB MIP PBB MIP
20 10% 0.50 100% 0.0 100% 100% 0.0 5.9 0.0 0.0 0.0 0.0 — —
20 20% 0.50 90% 0.4 100% 100% 0.0 19.8 0.4 0.4 0.0 0.0 — —
20 30% 0.50 37% 4.0 100% 100% 0.0 65.0 3.8 4.0 0.2 0.0 — —
20 10% 1.00 18% 4.4 100% 100% 0.1 556.0 4.3 4.2 0.1 0.2 — —
20 20% 1.00 0% 14.2 100% 100% 0.1 532.9 13.5 13.8 0.7 0.4 — —
20 30% 1.00 0% 24.3 100% 100% 0.1 469.9 23.4 23.5 0.9 0.8 — —
25 10% 0.50 100% 0.0 100% 100% 0.0 32.0 0.0 0.0 0.0 0.0 — —
25 20% 0.50 93% 0.4 100% 100% 0.0 102.2 0.4 0.4 0.0 0.0 — —
25 30% 0.50 27% 5.0 100% 100% 0.0 319.3 5.0 5.0 0.0 0.0 — —
25 10% 1.00 40% 2.3 100% 39% 0.3 ? 2.3 ? 0.0 ? — 4.1
25 20% 1.00 0% 14.3 100% 66% 0.8 ? 13.7 ? 0.6 ? — 14.9
25 30% 1.00 0% 29.9 100% 95% 2.0 ? 28.9 ? 1.0 ? — 29.9
30 10% 0.50 100% 0.0 100% 100% 0.0 72.2 0.0 0.0 0.0 0.0 — —
30 20% 0.50 88% 0.6 100% 99% 0.0 ? 0.6 ? 0.0 ? — 0.6
30 30% 0.50 24% 5.7 100% 99% 0.1 ? 5.7 ? 0.0 ? — 5.7
30 10% 1.00 6% 5.8 100% 3% 5.1 ? 5.7 ? 0.1 ? — 14.9
30 20% 1.00 0% 22.8 100% 7% 36.3 ? 22.4 ? 0.4 ? — 31.5
30 30% 1.00 0% 43.5 100% 31% 173.7 ? 43.2 ? 0.3 ? — 52.8
35 10% 0.50 100% 0.0 100% 100% 0.0 195.9 0.0 0.0 0.0 0.0 — —
35 20% 0.50 91% 0.4 100% 89% 0.2 ? 0.4 ? 0.0 ? — 0.6
35 30% 0.50 13% 7.7 100% 68% 18.5 ? 7.7 ? 0.0 ? — 8.0
35 10% 1.00 3% 6.2 100% 0% 64.7 ? 6.2 ? 0.0 ? — 33.5
35 20% 1.00 ? ? 92% 0% ? ? ? ? ? ? 29.6 130071.1
35 30% 1.00 ? ? 48% 0% ? ? ? ? ? ? 60.1 2990104.6
Table 1: Comparison of thePBB and MIPsolvers, each beinggiven one hourper instance
Recent work on workflow satisfiability has borrowed tech- ming problem and useoff-the-shelfsoftware tosolve there-
niques from theliterature on constraint satisfaction [7]. In- sulting problem. We tackle the problem of an unsatisfiable
deed, WSP may be regarded as a constraint satisfaction workflow specification in a different way. We assume the
problem,albeitwithsomeunusualfeatureswhichmakesthe constraints and authorisation policy are fixed and instead
study of WSP of interest in its own right. Recent work in associate costs with breaking the constraints and/or poli-
the constraint satisfaction community has made a distinc- cies. However, each violation will incur a cost and the goal
tionbetween“hard”and“soft”constraints: theformermust of Valued WSP is to minimise that cost. Thus our ap-
be satisfied, while the latter may be broken provided the proach provides greater flexibility than that of Basin et al.:
“cost”of breakingtheconstraint is taken intoaccount. we can break constraints as well as override the existing
authorisation policy. Obviously, there may be constraints
The valued constraint satisfaction problem, or VCSP for (arising from statutory requirements, say) that cannot be
short, was introduced by Schiex, Fargier and Verfaillie [22] broken. Violation of such a constraint is simply assigned
as a unifying framework for studying constraint program- the maximum cost. And of course, we can always refuse to
ming with soft constraints. The study of a special case of implement a plan proposed by thealgorithm.
VCSP,called finite-valued VCSP,was initiatedbyCohen et
al.[8]. Inthiscase,usefulformanyapplications,allweights Ourworkisalso related tothegrowing bodyofresearch on
areinZ(i.e.,finite)andtheobjectivefunctionisthesumof risk-based and risk-aware access control [4, 5, 12, 19]. In
appropriateweights. ValuedCSPhasinfluencedourframe- such approaches, the decision returned by policy decision
work for definingcosts and Valued WSP. point for a given access request is not necessarily a simple
“allow” or “deny”. The decision may be a number in the
RecentworkonWSPintroducedthenotionofapatternfor range [0,1] indicating the risk associated with allowing the
user-independentconstraints,andbespokealgorithms,opti- request, which allows thepolicy enforcement point to allow
misedtosolveWSPusingpatterns,havebeendeveloped[7, ordenytherequestonthebasisofcumulativerisk(eitheron
17]. Thebranch-and-boundalgorithminSection3.2isinflu- aper-userorsystembasis). Thedecisionmayalsoincludean
enced by thework of Karapetyan,Gagarin and Gutin [17]. obligation that must be fulfilled by the policy enforcement
pointorrequestertoensurethattheriskisrecordedand/or
The most closely related work in the literature on access mitigated appropriately.
controlinworkflowsisthatofBasin,BurriandKarjoth [2],
whichconsidersthecostofmodifyingtheauthorisationpol- There is little work in the security literature on risk-aware
icy when the workflow is unsatisfiable. They encode the workflows. OneexceptionistheMRARDframeworkofHan,
problemofminimizingthiscostasaintegerlinearprogram- NiandChen[15]. However,theemphasisoftheirwork(and
9
100 100
% %
d, d,
ve 50 ve 50
ol ol
S S
PBB PBB
MIP MIP
0 0
10 15 20 25 30 35 40 45 10 20 30 40 50 60
k k
(a)d=20%andα=1.00 (b)d=10%andα=0.75
Figure 1: Comparison of themethods in terms of theability to solve an instance within one hour
ofsimilarworkinthebusinessprocessingliterature)isonthe isminimised. Alternatively,wemayinsistthatausersession
modellingandcomputationofrisk,ratherthandetermining does not exceed a“budget”, where the cost of a session in
an optimal assignment of userstostepsin aworkflowgiven whichuseruinvokespermissionsQisdefinedtobeω(Q,u).
therisk metrics.
7. REFERENCES
6. CONCLUDINGREMARKS
[1] American National Standards Institute. ANSI
We have established a framework that enables us to rea-
INCITS 359-2004 for Role Based Access Control,
son about unsatisfiable workflow specifications by associat-
2004.
ingcostswithpolicyandconstraintviolations. This,inturn,
[2] Basin, D. A., Burri, S. J., and Karjoth, G.
enables us to formulate the Valued WSP, whose solution
Optimalworkflow-aware authorizations. In 17th ACM
providesan assignment of userstostepsthatminimises the
Symposium on Access Control Models and
total cost of violations. We have developed a bespoke al-
Technologies, SACMAT’12, Newark, NJ, USA – June
gorithm for solving Valued WSP and shown that its per-
20–22, 2012 (2012), V. Atluri,J. Vaidya,A. Kern,
formance is far better than a generic solver, both in terms
and M. Kantarcioglu, Eds., ACM, pp.93–102.
of the time taken to solve Valued WSP and the range of
instancesthatcanbesolvedinareasonableamountoftime. [3] Brewer, D. F. C., and Nash, M. J. The Chinese
Wall security policy. InIEEE Symposium on Security
There are several interesting possibilities for future work. and Privacy (1989), IEEE Computer Society,
Oneobviouspossibilityistomovetoacompletelyrisk-based pp.206–214.
approach for the assignment of users to steps in workflows. [4] Chen, L., and Crampton, J. Risk-aware role-based
Specifically, we retain the constraints but replace the au- access control. InSecurity and Trust Management -
thorisation policy with a risk matrix,associating each user- 7th International Workshop, STM 2011, Copenhagen,
step pair with a risk. The goal would be toensure that the Denmark, June 27–28, 2011, Revised Selected Papers
riskassociatedwithaworkflowinstanceremainsbelowsome (2011), C. Meadows and M. C. F. Gago, Eds.,
specified threshold. vol. 7170 of Lecture Notes in Computer Science,
Springer,pp.140–156.
Asecondpossibility arisesfrom theideaofassociating each [5] Cheng, P., Rohatgi, P., Keser, C., Karger,
pair(T,u)withacost,whichprovidesthebasisforanalter- P. A., Wagner, G. M., and Reninger, A. S. Fuzzy
native“non-linear”approachtoaccesscontrol. Supposethat multi-levelsecurity: An experimenton quantified
we consider a set of permissions P, as in conventional role- risk-adaptiveaccess control. In 2007 IEEE Symposium
based access control, and we associate a cost ω(Q,u) with on Security and Privacy (S&P 2007), 20–23 May
eachpair,whereuisauserandQisasubsetofP. Givenan 2007, Oakland, California, USA (2007), IEEE
RBACpolicy,expressedasauser-rolerelationUA⊆U×R ComputerSociety,pp.222–230.
and permission-role relation PA⊆R×P,we write P(u) to [6] Cohen, D., Crampton, J., Gagarin, A., Gutin,
denotethesetofpermissionsforwhichuisauthorised: that G., and Jones, M. Engineering algorithms for
is, P(u)={p∈P :∃r∈R,(u,r)∈UA,(r,p)∈PA}. Then workflow satisfiability problem with user-independent
we definetheweight of the policy to be constraints. In Frontiers in Algorithmics, FAW 2014
(2014), J. Chen,J. Hopcroft, and J. Wang, Eds.,
wA(UA,PA)= ω(P(u),u). vol. 8497 of Lecture Notes in Computer Science,
uX∈U Springer,pp.48–59.
This then raises some interesting questions that may have [7] Cohen, D., Crampton, J., Gagarin, A., Gutin,
practicalvalue. Wemight,forexample,considerthefollow- G., and Jones, M. Iterativeplan construction for the
ing problem: given inputs U, P, {ω(Q,u):u∈U,Q⊆P} workflow satisfiability problem. J. Artif. Intel. Res. 51
and integer k, compute a set of roles of R of cardinality k (2014), 555–577.
andrelationsUA⊆U×RandPA⊆R×P suchthatatleast [8] Cohen, D. A., Cooper, M. C., Jeavons, P. G.,
oneuserisauthorisedforeverypermissionandwA(UA,PA) and Krokhin, A. A. The complexity of soft
10