Model-driven approach enabling formalization and conformance testing of attribute-based access control policies for business processes

Abstract

Access control policies (ACPs) are essential for creating a secure access control system. ACPs are often studied and specified based on access control models, such as attribute-based access control (ABAC). Moreover, the execution of business process instances is typically recorded in a business process event log. Ensuring conformance with ABAC policies for the process log at the time of post-execution is crucial. To perform conformance testing of ABAC policies for event logs, it is necessary to formalize the ABAC policies. However, this formalization is typically carried out manually, leading to low efficiency and maintainability, as well as a high risk of errors and difficulty in detecting them. Also, the top-down approach for ABAC policy engineering is often less feasible due to the challenges and costs associated with manually developing ABAC policies, which makes it difficult to document security requirements. Besides, there is a lack of an ABAC metamodel that supports the formalization and conformance testing of ABAC policies, and little attention is paid to constructing ABAC policies from existing event logs. This paper presents a fine-grained and highly automated model-driven framework enabling the formalization and conformance testing of ABAC policies for business processes. In our approach, an ABAC metamodel and its patterns are proposed to solve the problems mentioned above. The approach is experimented with and evaluated on three business processes: One simulated and two real-world processes.