Security Constraints in Temporal Role-Based Access-Controlled Workflows

ABSTRACT

Workflows and role-based access control models need to be suitably merged, in order to allow users to perform processes in a correct way, according to the given data access policies and the temporal constraints. Given a mapping between workflow models and simple temporal networks with uncertainty, we discuss a mapping between role temporalities and simple temporal networks, and how to connect the two resulting networks to make explicit who can do what, when. If the connected network is still executable, we show how to compute the set of authorized users for each task. Finally, we define security constraints (to prevent users from doing unauthorized actions) and security constraint propagation rules (to propagate security constraints at runtime). We also provide an algorithm to check whether a set of propagation rules is safe, and we extend an existing execution algorithm to take into account these new security aspects.

References

1. A. Armando and S. Ranise. Automated Symbolic Analysis of ARBAC-Policies. In Proc. of STM, pages 17--34, 2010.
2. E. Bertino, C. Bettini, E. Ferrari, and P. Samarati. An access control model supporting periodicity constraints and temporal reasoning. ACM Trans. Database Syst., 23(3):231--285, 1998.
3. E. Bertino, P. A. Bonatti, and E. Ferrari. TRBAC: A temporal role-based access control model. ACM Trans. Inf. Syst. Secur., 4(3):191--233, 2001.
4. E. Bertino, P. A. Bonatti, E. Ferrari, and M. L. Sapino. Temporal authorization bases: From specification to integration. Journal of Computer Security, 8(4):309--353, 2000.
5. E. Bertino, E. Ferrari, and V. Atluri. The specification and enforcement of authorization constraints in workflow management systems. ACM Trans. Inf. Syst. Secur., 2(1):65--104, 1999.
6. D. Cohen, J. Crampton, A. Gagarin, G. Gutin, and M. Jones. Iterative plan construction for the workflow satisfiability problem. JAIR, 51:555--577, 2014.
7. C. Combi, M. Gambini, S. Migliorini, and R. Posenato. Representing business processes through a temporal data-centric workflow modeling language: An application to the management of clinical pathways. IEEE T. Systems, Man, and Cybernetics: Systems, 44(9):1182--1203, 2014.
8. C. Combi, L. Viganò, and M. Zavatteri. Security Constraints in Temporal Role-Based Access-Controlled Workflows (Extended Version). http://arxiv.org/abs/1512.06404, 2015.
9. T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein. Introduction to Algorithms. MIT Press, 2009.
10. J. Crampton. A reference monitor for workflow systems with constrained task execution. In Proc. of SACMAT, pages 38--47. ACM Press, 2005.
11. J. Crampton, A. V. Gagarin, G. Gutin, and M. Jones. On the Workflow Satisfiability Problem with Class-independent Constraints. In Proc. of IPEC, pages 66--77, 2015.
12. J. Crampton, G. Gutin, and A. Yeo. On the parameterized complexity and kernelization of the workflow satisfiability problem. ACM Trans. Inf. Syst. Secur., 16(1):4, 2013.
13. J. Crampton, M. Huth, and J. H. Kuo. Authorized workflow schemas: deciding realizability through LTL(F) model checking. STTT, 16(1):31--48, 2014.
14. R. Dechter, I. Meiri, and J. Pearl. Temporal Constraint Networks. In Proc. of KR, pages 83--93, 1989.
15. L. Hunsberger, R. Posenato, and C. Combi. The Dynamic Controllability of Conditional STNs with Uncertainty. In Proc. of PlanEx, pages 1--8, 2012.
16. S. Mondal and S. Sural. Security analysis of temporal-rbac using timed automata. In Proc. of IAS 2008, pages 37--40, 2008.
17. P. H. Morris. A structural characterization of temporal dynamic controllability. In Proc. of CP, pages 375--389, 2006.
18. P. H. Morris and N. Muscettola. Execution of temporal plans with uncertainty. In Proc. of AAAI, pages 491--496, 2000.
19. P. H. Morris and N. Muscettola. Temporal Dynamic Controllability Revisited. In Proc. of AAAI, pages 1193--1198, 2005.
20. P. H. Morris, N. Muscettola, and T. Vidal. Dynamic Control Of Plans With Temporal Uncertainty. In Proc. of IJCAI, pages 494--502, 2001.
21. M. Niezette and J. Stevenne. An Efficient Symbolic Representation of Periodic Time. In Proc. of CIKM, pages 161--168. ISMM, 1992.
22. F. Paci, E. Bertino, and J. Crampton. An access-control framework for WS-BPEL. Int. J. Web Service Res., 5(3):20--43, 2008.
23. S. Ranise, A. Tuan Truong, and L. Viganò. Automated analysis of RBAC policies with temporal constraints and static role hierarchies. In Proc. of SAC, pages 2177--2184, 2015.
24. R. S. Sandhu. Roles versus groups. In ACM Workshop on Role-Based Access Control, 1995.
25. R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman. Role-based access control models. IEEE Computer, 29(2):38--47, 1996.
26. D. Toman and J. Chomicki. Datalog with integer periodicity constraints. J. Log. Program., 35(3):263--290, 1998.
27. T. Vidal and H. Fargier. Handling contingency in temporal constraint networks: from consistency to controllabilities. J. Exp. Theor. Artif. Intell., 11(1):23--45, 1999.
28. Q. Wang and N. Li. Satisfiability and resiliency in workflow authorization systems. ACM Trans. Inf. Syst. Secur., 13(4):40, 2010.

Index Terms

• Computing methodologies

  • Artificial intelligence

    • Knowledge representation and reasoning

      • Temporal reasoning

• Security and privacy

  • Formal methods and theory of security

  • Security services

    • Access control

    • Authorization