Change-Driven Analysis of Timed Security Requirements for Data-Aware Workflow Processes

In recent years, due to the complexity of workflow processes (or business processes) and the fluctuation of business environments, the timed security requirements (or constraints) of workflow processes have attracted more and more attentions from the designers and users of workflow processes. The existing methods cannot analyze the security requirements of data-aware workflow processes with dynamic changes. In this paper, we propose a novel change-driven security analysis approach (CDSA approach) to verify timed security requirements for data-aware workflow processes with dynamic changes. First, we analyze the feasibility of changes on workflow processes. Second, we propose the analysis procedure to automatically determine the affected segments of changes. Third, the timed security requirements affected by changes are obtained and verified without repeatedly analyzing all of them. Compared with the existing works, our approach can detect incorrect changes in advance so as to avoid meaningless analysis, also can reduce the cost and time of enterprises as well as eliminate repeated verification of all timed security requirements. Note to Practitioners—Security analysis of workflow processes (or business processes) is an emerging but crucial area for enterprises and supply chains. In this paper, we present a novel approach to analyze data-aware workflow processes with dynamic changes under timed security requirements. It is structured into three phases: 1) feasibility analysis of changes, 2) determination of affected segments, and 3) verification of timed security requirements. The proposed approach can detect incorrect changes in advance and avoid repetitive analysis, but also effectively and efficiently verify the timed security requirements after changes by determining the affected workflow processes and segments. This can greatly improve the efficiency of verification, so that the cost and time of enterprises can be significantly reduced. A real-life case is used to illustrate the feasibility of the proposed concepts and approach.