Delegation Security Analysis in Workflow Systems

User delegation is a type of access control mechanisms that allow a person to delegate all or part of his
$/$
her authorities to others. It is an important access control policy that can significantly improve workflow flexibility. A crucial requirement after delegations is to check the satisfiability of workflow, i.e., determining whether there exists a valid execution schedule (
$ES$
) in the workflow that can ensure it to proceed from the beginning to the end while satisfying all authorization constraints. Existing works perform in a centralized manner to find such a valid
$ES$
by exploring all
$ES$
s. Unfortunately, the enumeration of
$ES$
s is highly inefficient from the perspective of computational complexity. This study proposes a novel approach to overcoming this difficulty in a distributed way. First, we use Petri nets (PNs) to formalize workflow and user delegations. Then, we directly specify a conflict-free workflow that satisfies all authorization constraints. Hence, determining the satisfiability of a workflow amounts to directly checking the existence of
$ES$
s in the corresponding conflict-free workflow. Finally, we present a distributed strategy, which is of polynomial complexity, to determine the existence of
$ES$
s.