Solving the Workflow Satisfiability Problem using General Purpose Solvers

TL;DR

This paper shows that general-purpose solvers can efficiently solve the workflow satisfiability problem (WSP) with arbitrary constraints by using FPT-aware formulations, making it practical for real-world access control scenarios.

Contribution

It introduces the concept of branching factor for non-UI constraints and demonstrates that general-purpose solvers can achieve fixed-parameter tractable performance on WSP.

Findings

General-purpose solvers can solve WSP with arbitrary constraints efficiently.

The notion of branching factor helps handle non-UI constraints.

FPT-like performance is achievable with appropriate formulations.

Abstract

The workflow satisfiability problem (WSP) is a well-studied problem in access control seeking allocation of authorised users to every step of the workflow, subject to workflow specification constraints. It was noticed that the number $k$ of steps is typically small compared to the number of users in the real-world instances of WSP; therefore $k$ is considered as the parameter in WSP parametrised complexity research. While WSP in general was shown to be W[1]-hard, WSP restricted to a special case of user-independent (UI) constraints is fixed-parameter tractable (FPT). However, restriction to the UI constraints might be impractical. To efficiently handle non-UI constraints, we introduce the notion of branching factor of a constraint. As long as the branching factors of the constraints are relatively small and the number of non-UI constraints is reasonable, WSP can be solved in FPT time. Extending the results from Karapetyan et al. (2019), we demonstrate that general-purpose solvers are capable of achieving FPT-like performance on WSP with arbitrary constraints when used with appropriate formulations. This enables one to tackle most of practical WSP instances. While important on its own, we hope that this result will also motivate researchers to look for FPT-aware formulations of other FPT problems.