Satisfiability and Resiliency in Workflow Systems

We propose the role-and-relation-based access control (R2 BAC) model for workflow systems. In R2 BAC, in addition to a user's role memberships, the user's relationships with other users help determine whether the user is allowed to perform a certain step in a workflow. For example, a constraint may require that two steps must not be performed by users who have a conflict of interest. We also study the workflow satisfiability problem, which asks whether a set of users can complete a workflow. We show that the problem is NP-complete for R2 BAC, and is NP-complete for any workflow model that supports certain simple types of constraints (e.g., constraints that state certain two steps must be performed by two different users). After that, we apply tools from parameterized complexity theory to better understand the complexities of this problem. We show that the problem is fixed-parameter tractable when the only relations used are = and =, and is fixed-parameter intractable when use...

• Type: Conference
• Year: 2007
• Where: ESORICS
• Authors: Qihua Wang, Ninghui Li
• Keywords: ESORICS 2007, Security Privacy, Workflow, Workflow Satisfiability Problem, Workflow Systems