Work ow technology has emerged as one of the leading technologies for modeling,
(re)designing and executing business processes in several di erent application
domains such as industrial R&D, manufacturing, energy distribution, banking
processes, critical infrastructures and healthcare. A work ow is the automation
of a business process, in whole or part, during which documents, information or
tasks are passed from one participant to another for action, according to a set of
procedural rules. The conceptual modeling of work ows underlying business
processes has been receiving increasing attention over the last years and many
technical aspects have been discussed, including exibility, structured vs.
unstructured modeling, change management, authorization models, temporal features,
resource allocation, failure resistance and constraints (see, e.g., [
Recently, attention was devoted in particular to the issue of expressing
temporal features of work ows, such as task-duration constraints, temporal constraints
between non-consecutive tasks, delays, deadlines and so on [
The authors of [
Work ows also deal with the management of associated resources in order to complete business processes. In this thesis I considered, from a security point of view, the most trivial of resources: users. When we talk about security in the business process context, we must also talk about access control models, security policies and authorization constraints.
Therefore, an access-controlled work ow extends a classical work ow by adding
users and authorization constraints. Users are authorized for tasks whereas
authorization constraints say which users remain authorized for which tasks
depending on who did what. Role-based access control models (RBAC, [
Some proposals attempted at extending RBAC models to address such
constraints, e.g., [
When an access controlled work ow does not specify any uncontrollable part work ow satis ability is enough to synthesize a valid plan. Instead, when some part is out of control (e.g., the choice of the work ow path or the absence of users), we need, as for temporal work ows discussed above, a controllability approach to decide in real time which users to commit to which tasks. For example, consider an access controlled work ow under conditional uncertainty. In this work ow, the choices of the work ow paths to take are out of control (or by abusing language we say that these work ow paths are uncontrollable). Di erently from the WSP, the assignment of a user to a task might not be precomputed before starting as the work ow may in general specify di erent authorization constraints for di erent work ow paths involving the same users for some common tasks which must be considered in any execution. In that case, we must make this assignment while executing, typically after having full information on which work ow path we will go through (online planning).
Another controllability problem in the context of work ows with resources
is the work ow resiliency problem (WRP), i.e., a dynamic WSP coping with the
absence of users. If a work ow is resilient, it is of course satis able, but the
vice versa does not hold. A few years ago, Wang and Li de ned three levels of
resiliency: static (level 1), decremental (level 2) and dynamic (level 3) [
Finally, we can of course consider variants of the previously discussed aspects. For instance, a work ow employing users and temporal constraints may specify a temporal separation (or binding) of duties. A temporal SoD says that a user is allowed to carry out two tasks provided a further temporal constraint is satis ed. For example, a surgeon, who has just carried out a 4-hour intervention, is allowed to do another one only after resting from 2 to 4 hours. Likewise, an aircraft pilot must rest for at least 10 hours after a transatlantic ight. These temporal constraints must be considered in conjunction with access control as there is a mutual in uence. However, when everything is under control, these constraints boil down to normal disjunctions for which a satis ability approach is enough. The interesting part is when some part is, again, out of control. Consider again a transatlantic ight taking o from Europe and suppose that once the aircraft lands in America, it will take o again 12 hours after the expected landing time (so potentially the same pilot is ne for the return ight). However, the exact duration of the outbound ight is uncontrollable. Suppose that it takes normally 10 hours. Once boarding is complete, the take o could be delayed for extreme weather conditions and related safety procedures such as, for example, deicing. Deicing is the process of removing snow and ice from the plane surfaces (especially wings) by \power washing" the aircraft with chemicals which also remain on the surfaces in order to prevent the reformation of the ice. If deicing process takes 3 hours (as each plane queues for its turn), the ight will land after 13 hours since boarding. As a result, the next take o will be scheduled after 9 (and no longer 12) hours, so the same pilot is not going to be ne.
To the best of my knowledge security policies involving temporal, conditional and resource uncertainty still need to be explored in depth.
When facing uncontrollable parts we can in general act in three main ways: 1. We assume that we know in advance how the uncontrollable part will behave and make sure that a (possibly di erent) strategy to operate on the controllable part exists. 2. We assume that we have a xed strategy operating on the controllable part always the same way no matter how the uncontrollable one will behave. 3. We assume that we have a strategy operating (possibly di erently) on the same controllable part making decisions in real time depending on how the uncontrollable part is behaving (online planning).
These are the intuitions behind the three main kinds of controllability: weak (for presumptuous), strong (for anxious) and dynamic (for grandmasters). 2
Towards these unexplored directions, my contributions fall in the areas of
constraint satisfaction, uncertainty in AI, planning and scheduling, algorithms,
business process management and security and are the following.
1. I address temporal controllability of work ows specifying controllable and
uncontrollable work ow paths and uncontrollable task durations. This part
relies on temporal constraint networks. I provide conditional simple
temporal networks with uncertainty and decisions (CSTNUDs) as a new temporal
network formalism and an encoding from temporal work ows into
CSTNUDs. I also address simple temporal networks with decisions (STNDs), a
subclass of CSTNUDs equivalent to DTNs (disjunctive temporal networks). I
provide Esse (https://github.com/matteozavatteri/esse) and Kappa
(http://regis.di.univr.it/EE_STND2018.tar.bz2), two tools for
CSTNUDs and STNDs, respectively, with which I carry out a few experimental
evaluations. The results I obtained are published in [