Algorithms for the workflow satisfiability problem engineered for counting constraints

TL;DR

This paper develops and evaluates an efficient fixed-parameter tractable algorithm for solving the workflow satisfiability problem with user-independent counting constraints, comparing it to a SAT-based approach.

Contribution

It presents a novel implementation of an FPT algorithm for this subclass of WSP and compares its performance with a pseudo-Boolean SAT solver.

Findings

The FPT algorithm efficiently solves large instances of WSP with counting constraints.

The SAT-based approach provides competitive performance on certain problem instances.

The paper offers insights into practical methods for workflow security constraint satisfaction.

Abstract

The workflow satisfiability problem (WSP) asks whether there exists an assignment of authorized users to the steps in a workflow specification that satisfies the constraints in the specification. The problem is NP-hard in general, but several subclasses of the problem are known to be fixed-parameter tractable (FPT) when parameterized by the number of steps in the specification. In this paper, we consider the WSP with user-independent counting constraints, a large class of constraints for which the WSP is known to be FPT. We describe an efficient implementation of an FPT algorithm for solving this subclass of the WSP and an experimental evaluation of this algorithm. The algorithm iteratively generates all equivalence classes of possible partial solutions until, whenever possible, it finds a complete solution to the problem. We also provide a reduction from a WSP instance to a pseudo-Boolean SAT instance. We apply this reduction to the instances used in our experiments and solve the resulting PB SAT problems using SAT4J, a PB SAT solver. We compare the performance of our algorithm with that of SAT4J and discuss which of the two approaches would be more effective in practice.