Security Policies for WFMS with Rich Business Logic - A Model Suitable for Analysis
F\'abio Jos\'e Muneratti Ortega, Wilson Vicente Ruggiero

TL;DR
This paper presents a formal metamodel for security policies in workflow management systems that integrates complex business rules with traditional access control, enabling effective analysis and validation through Petri nets.
Contribution
The paper introduces a novel formal metamodel for security policies that combines business logic with access control, facilitating analysis and validation using Petri nets.
Findings
Successful modeling of an online banking security policy
Feasibility demonstrated for policy validation via state-space analysis
State-space fractioning reduces analysis complexity
Abstract
This paper introduces a formal metamodel for the specification of security policies for workflows in online service systems designed to be suitable for the modeling and analysis of complex business-related rules as well as traditional access control. A translation of the model into a colored Petri net is shown and an example of policy for an online banking system is described. By writing predicates for querying the resulting state-space of the Petri net, a connection between the formalized model and a higher-level description of the security policy can be made, indicating the feasibility of the intended method for validating such descriptions. Thanks to the independent nature among tasks related to different business services, represented by restrictions in the information flow within the metamodel, the state-space may be fractioned for analysis, avoiding the state-space explosion…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAccess Control and Trust · Service-Oriented Architecture and Web Services · Business Process Modeling and Analysis
