Verifying Security Policies in Multi-agent Workflows with Loops
This addresses security verification for multi-agent systems like conference submission platforms, offering a formal method to ensure policy compliance in complex workflows.
The paper tackles the problem of automatically verifying information flow security policies in web-based workflows with loops and unbounded agents, reducing it to a satisfiability problem and providing decidability results for relevant classes.
We consider the automatic verification of information flow security policies of web-based workflows, such as conference submission systems like EasyChair. Our workflow description language allows for loops, non-deterministic choice, and an unbounded number of participating agents. The information flow policies are specified in a temporal logic for hyperproperties. We show that the verification problem can be reduced to the satisfiability of a formula of first-order linear-time temporal logic, and provide decidability results for relevant classes of workflows and specifications. We report on experimental results obtained with an implementation of our approach on a series of benchmarks.