Grouping access control violations for process-aware systems

1. A computer-implemented method for analyzing access control violations of a computer-implemented process, the method being executed using one or more processors and comprising:

receiving, by the one or more processors, a request comprising violation data indicating an access control violation that occurred during execution of the computer-implemented process;

requesting, by the one or more processors, a process model from a process model database, the process model comprising a computer-readable representation of the computer-implemented process, the process model comprising a task corresponding to the access control violation;

processing, by the one or more processors, the task and the process model to provide correlation data comprising one or more of grouped violations, a set of granted accesses, and a set of violations by:

determining, based on the task and the process model, a set of predecessor tasks relative to the task, each task in the set of predecessor tasks being required to be executed to achieve a goal of the process,

determining, based on the set of predecessor tasks, a set of paths, each path defining a series of tasks from a respective predecessor task that are performed to achieve the goal of the process, and

providing the grouped violations based on paths in the set of paths and provided based on log data provided from a system log, the log data comprising one or more access request violations; and

transmitting, by the one or more processors, the correlation data to a client-side computing device for display to a user.

2. The method of claim 1 , wherein processing the task and the process model comprises:

receiving a computer-readable security policy associated with the process model; and

identifying constrained tasks of the process model based on the computer-readable security policy, wherein the set of violations and the set of granted accesses are provided based on the constrained tasks.

3. The method of claim 2 , wherein the set of violations and the set of granted accesses are further provided based on log data provided from a system log, the log data comprising one or more access request violations.

4. The method of claim 2 , wherein constraints associated with constrained tasks comprise one or more of separation of duty, binding of duty, and need-to-know.

5. The method of claim 1 , wherein the process model comprises a predefined process model, or an empirically determined process model.

6. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for analyzing access control violations of a computer-implemented process a, the operations comprising:

receiving a request comprising violation data indicating an access control violation that occurred during execution of the computer-implemented process;

requesting a process model from a process model database, the process model comprising a computer-readable representation of the computer-implemented process, the process model comprising a task corresponding to the access control violation;

processing the task and the process model to provide correlation data comprising one or more of grouped violations, a set of granted accesses, and a set of violations by:

determining, based on the task and the process model, a set of predecessor tasks relative to the task, each task in the set of predecessor tasks being required to be executed to achieve a goal of the process,

determining, based on the set of predecessor tasks, a set of paths, each path defining a series of tasks from a respective predecessor task that are performed to achieve the goal of the process, and

providing the grouped violations based on paths in the set of paths and provided based on log data provided from a system log, the log data comprising one or more access request violations; and

transmitting the correlation data to a client-side computing device for display to a user.

7. The computer-readable storage medium of claim 6 , wherein processing the task and the process model comprises:

receiving a computer-readable security policy associated with the process model; and

identifying constrained tasks of the process model based on the computer-readable security policy, wherein the set of violations and the set of granted accesses are provided based on the constrained tasks.

8. The computer-readable storage medium of claim 7 , wherein the set of violations and the set of granted accesses are further provided based on log data provided from a system log, the log data comprising one or more access request violations.

9. The computer-readable storage medium of claim 7 , wherein constraints associated with constrained tasks comprise one or more of separation of duty, binding of duty, and need-to-know.

10. The computer-readable storage medium of claim 8 , wherein the process model comprises a predefined process model, or an empirically determined process model.

11. A system, comprising:

a computing device; and

a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for analyzing access control violations of a computer-implemented process, the operations comprising:

receiving a request comprising violation data indicating an access control violation that occurred during execution of the computer-implemented process;

requesting a process model from a process model database, the process model comprising a computer-readable representation of the computer-implemented process, the process model comprising a task corresponding to the access control violation;

processing the task and the process model to provide correlation data comprising one or more of grouped violations, a set of granted accesses, and a set of violations by:

determining, based on the task and the process model, a set of predecessor tasks relative to the task, each task in the set of predecessor tasks being required to be executed to achieve a goal of the process,

determining, based on the set of predecessor tasks, a set of paths, each path defining a series of tasks from a respective predecessor task that are performed to achieve the goal of the process, and

providing the grouped violations based on paths in the set of paths and provided based on log data provided from a system log, the log data comprising one or more access request violations; and

transmitting the correlation data to a client-side computing device for display to a user.

12. The system of claim 11 , wherein processing the task and the process model comprises:

receiving a computer-readable security policy associated with the process model; and

identifying constrained tasks of the process model based on the computer-readable security policy, wherein the set of violations and the set of granted accesses are provided based on the constrained tasks.

13. The system of claim 12 , wherein the set of violations and the set of granted accesses are further provided based on log data provided from a system log, the log data comprising one or more access request violations.

14. The system of claim 12 , wherein constraints associated with constrained tasks comprise one or more of separation of duty, binding of duty, and need-to-know.