Verifying Security Policies in Multi-agent Workflows with Loops
Bernd Finkbeiner, Christian Müller, Helmut Seidl and Eugen Zălinescu
We consider the automatic verification of information flow security policies of web-based workflows, such as conference submission systems like EasyChair. Our workflow description language allows for loops, non-deterministic choice, and an unbounded number of participating agents. The information flow policies are specified in a temporal logic for hyperproperties. We show that the verification problem can be reduced to the satisfiability of a formula of first-order linear-time temporal logic, and provide decidability results for relevant classes of workflows and specifications. We report on experimental results obtained with an implementation of our approach on a series of benchmarks.
24th ACM Conference on Computer and Communications Security (CCS 2017).
RS3 Best Paper Award 2016/2017.