ProMTEE: Secrecy Preservation For Online Process Monitoring with TEEs.pdf

The online monitoring of collaborative business processes involves the integration of event data sourced from various information systems into a unified process state. The transmission of process records across organizational boundaries poses significant data secrecy and security challenges. In this context, organizations may be reluctant to outsource sensitive data with their collaborators to update a global process state. In this paper, we propose ProMTEE, a novel framework designed to tackle these challenges by resorting to trusted applications running in Trusted Execution Environments (TEEs). To showcase the potential of ProMTEE, we contextualize its four-staged interaction protocol within the realm of two online monitoring tasks, namely, control flow tracking and compliance monitoring. We verify the security of our solution through a threat analysis against a set of security requirements derived from a supply-chain scenario. In addition, we conduct an experimental assessment of our proof-of-concept implementation with tests on memory usage and latency using real-world datasets.

1. SecrecyPreservationfor
Online Process
Monitoring with Trusted
ExecutionEnvironment
Davide Basile, Sapienza University of Rome, Italy
Claudio Di Ciccio, Utrecht University, Netherlands

2. 2
Online processmonitoring
<event>
<string key=“case:concept:name" value="P_01_2025” />
<string key="concept:name" value="Get Order"/>
<date key="time:timestamp" value="2024 -01-15T09:30:00/>
</event>
<event>
<string key=“case:concept:name" value="P_01_2025”/>
<string key="concept:name" value=“Confirm Order"/>
<date key="time:timestamp" value="2024-01-15T10:15:00/>
</event>
Event stream
t t’
…
Runtime
insights

3. 3
Monitoring a collaborative scenario

4. 4
Control flow tracking
Case PO24#1
Status: Running
Enabled:
,
Monitoring a collaborative scenario

5. 5
Monitoring a collaborative scenario

6. 6
A12B8L123A12B8L123
Compliance monitoring
Monitoring a collaborative scenario
Case PO24#1
Rule:
Status: Violated

7. 7
Secrecyconcernsin processmonitoring

8. 8
Secrecyconcernsin processmonitoring
t
e

9. 9
Secrecyconcernsin processmonitoring
t’
e’

10. 10
Secrecyconcernsin processmonitoring
t’’
e’’

11. 11
Secrecyconcernsin processmonitoring
t’’’
e’’’

12. 12
Secrecyconcernsin processmonitoring
t’’’’
e’’’’

13. 13
Secrecyconcernsin processmonitoring
t’’’’’
e’’’’’

14. 14
Secrecyconcernsin processmonitoring

15. 15
Secrecyconcernsin processmonitoring

16. 16
Secrecyconcernsin processmonitoring

17. 17
Secrecyconcernsin processmonitoring

18. 18
Researchobjective
<event>
<string key=‘case:concept:name’ value=‘PO24#1’ >
<string key=‘concept:name’ value=‘Fill in Container’/>
<date key=‘time:timestamp’ value=‘2024-11-04T16:05:06’/>
<string key=‘Container ID’ value=‘TGHU75993’
<string key=‘Logistics Operator’ value= ‘A12B8L123’/>
</event>
Case P024#1
Status: Running
Enabled: Check Container
Case P024#1
Status: Violated
Rule: Separationof duty (C3)

19. 19
Researchobjective
<event>
<string key=‘case:concept:name’ value=‘PO24#1’ >
<string key=‘concept:name’ value=‘Fill in Container’/>
<date key=‘time:timestamp’ value=‘2024-11-04T16:05:06’/>
<string key=‘Container ID’ value=‘TGHU75993’
<string key=‘Logistics Operator’ value= ‘A12B8L123’/>
</event>
Case P024#1
Status: Running
Enabled: Check Container
Case P024#1
Status: Violated
Rule: Separationof duty (C3)
Trust in event usage Output verifiability

20. 20
ProMTEEframework
ProMTEEarchitecture ProMTEEinteraction protocol

21. 21
ProMTEEframework
ProMTEEarchitecture ProMTEEinteraction protocol
Control flow tracking Compliance monitoring
Applied to
Case P024#1
Status: Running
Enabled: Check Container
Case P024#1
Status: Violated
Rule: Separationof duty (C3)

22. 22
TrustedExecutionEnvironments
In-clearCPU-encrypted
TEE-enabled
CPU
DRAM
Trustedapp

23. 23
ProMTEE
Architecture

24. 24
ProMTEEprocessstate
Accessiblesection
Secret section

25. 25
Accessiblesection
Monitoredprocessdimensions
Secret section
ProMTEEprocessstate

26. 26
Accessiblesection
Monitoredprocessdimensions
Case P024#1
Status: Running
Enabled: Check Container (CC)
Secret section
Control flow field
ProMTEEprocessstate

27. 27
Accessiblesection
Control flow field Business rule field
Monitoredprocessdimensions
Case P024#1
Status: Running
Enabled: Check Container (CC)
Case P024#1
Rule: Separationof duty (C3)
Status: TemporarilySatisfied
Secret section
ProMTEEprocessstate

28. 28
Accessiblesection
Secret section
Monitoredprocessdimensions
Case P024#1
Status: Running
Enabled: Check Container (CC)
Case P024#1
Rule: Separationof duty (C3)
Status: TemporarilySatisfied
Relevantevent data
<event>
<string key=‘case:concept:name’ value=‘PO24#1’/>
<string key=‘concept:name’ value=‘Fill in Container’/>
<date key=‘time:timestamp’ value=‘2024-11-04T16:05:06’/>
<string key=‘Container ID’ value=‘TGHU75993’
<string key=‘Logistics Operator’ value= ‘A12B8L123’/>
</event>
Control flow field Business rule field
ProMTEEprocessstate

29. 29
Functionalarchitectureand deployment
Event Stream Generator
<<device>>
Information System Machine
ProcessState Agent
<<device>>
Client Machine
<<data link>>
Event generation

30. 30
Functionalarchitectureand deployment
Event Stream Generator
<<device>>
Information System Machine
ProcessState Agent
<<data link>>
Event generation
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessState
<<device>>
Monitor Machine
<<data link>>
Secure event transmission
ProcessVault
<<device>>
Client Machine

31. 31
Components of a ProcessVault
<<executionenvironment>>
TrustedExecutionEnvironment
Event Dispatcher
(Fixed)
ProcessState Manager
(Fixed)
Control Flow Tracker
(Process-based)
Compliance Rule Tracker
(Process-based)
ProcessVault

32. 32
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessState Manager
(Fixed)
Control Flow Tracker
(Process-based)
Compliance Rule Tracker
(Process-based)
ProcessVault
Process
State
Components of a ProcessVault
Event Dispatcher
(Fixed)

33. 33
<<executionenvironment>>
TrustedExecutionEnvironment
Event Dispatcher
(Fixed)
ProcessState Manager
(Fixed)
Control Flow Tracker
(Process-based)
Compliance Rule Tracker
(Process-based)
ProcessVault
ProcessTrackers
Process
State
Components of a ProcessVault

34. 34
Integration of state-of-the art algorithms
Control Flow Tracker
(Process-based)
Compliance Rule Tracker
(Process-based)
van der Aalst, W.M.P.: The application of petri nets to workflow management. J. Circuits Syst.Comput. 8(1), 21–66 (1998)
References
Maggi, F.M., Montali, M., van der Aalst, W.M.P.: An operational decision support framework for monitoring business constraints.
In: FASE 2012. vol. 7212, pp. 146–162 (2012)

35. 35
Integration of state-of-the art algorithms
Control Flow Tracker
(Process-based)
Compliance Rule Tracker
(Process-based)
Workflow net firingmechanism
van der Aalst, W.M.P.: The application of petri nets to workflow management. J. Circuits Syst.Comput. 8(1), 21–66 (1998)
References
Maggi, F.M., Montali, M., van der Aalst, W.M.P.: An operational decision support framework for monitoring business constraints.
In: FASE 2012. vol. 7212, pp. 146–162 (2012)
P
l
a
c
e
Transition Case
P
l
a
c
e
Marking
Input/Output
matrices

36. 36
Integration of state-of-the art algorithms
Control Flow Tracker
(Process-based)
Compliance Rule Tracker
(Process-based)
Workflow net firingmechanism
van der Aalst, W.M.P.: The application of petri nets to workflow management. J. Circuits Syst.Comput. 8(1), 21–66 (1998)
References
Maggi, F.M., Montali, M., van der Aalst, W.M.P.: An operational decision support framework for monitoring business constraints.
In: FASE 2012. vol. 7212, pp. 146–162 (2012)
Reactivereasoner
Declarative
predicates
event.concept:name== "Retrieve goods"
event.product_units" < 1000
β
α
γ
P
l
a
c
e
Transition Case
P
l
a
c
e
Rule C1
Rule C2
Rule C3
Finite
state
machines
Marking
Input/Output
matrices

37. The ProMTEE
protocol
37

38. 38
Phasesof the ProMTEEprotocol

39. 39
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol

40. 40
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
Input:
Control flow specification
ProMTEEprotocol

41. 41
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
Input:
Business rule specification
ProMTEEprotocol

42. Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
Input:
42
Extractionmanifest
ProMTEEprotocol

43. 43
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
Control flow specification
<<executionenvironment>>
Operating System
ProcessVaultCompiler
Input
Business rule specification
Extractionmanifest
ProMTEEprotocol

44. ProcessVaultCompiler
44
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
<<executionenvironment>>
Operating System
Extractroutinglogic
Extract
business rule
logic
ProMTEEprotocol

45. 45
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
<<executionenvironment>>
Operating System
ProcessVaultCompiler
Control Flow
Tracker
Compliance
Rule Tracker
Generate source code
ProMTEEprotocol

46. 46
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<device>>
Monitor Machine
<<executionenvironment>>
Operating System
ProcessVaultCompiler
Event Dispatcher
ProcessState Manager
ProcessVault
Control Flow
Tracker
Compliance
Rule Tracker
<<executionenvironment>>
TrustedExecutionEnvironment
LaunchTrustedApp
TrustedApp measurement
a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4
ProMTEEprotocol

47. 48
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProcessState Agent
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
(Event Dispatcher)
ProMTEEprotocol
Trustedsubscription
Secure event transmission

48. 49
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProcessState Agent
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
(Event Dispatcher)
ProMTEEprotocol
Trustedsubscription
Custom data
Provisioning key (random)
Organization identityproof
Measurement
CPU-signed
a7b8c9d0e1f2a3b4c5
d6e7f8a9b0c1d2e3f4
Secure event transmission
Periodic
TEE attestationevidences
Subscribed

49. 50
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProcessState Agent
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
(Event Dispatcher)
ProMTEEprotocol
Trustedsubscription
Custom data
Provisioning key (random)
Organization identityproof
Measurement
CPU-signed
a7b8c9d0e1f2a3b4c5
d6e7f8a9b0c1d2e3f4
Secure event transmission
Processevent stream
Subscribed
Periodic
TEE attestationevidences

50. 51
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Event Dispatcher
Event Stream Generator
ProcessState Agent
Subscribed

51. 52
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
Event Stream Generator
ProcessState Agent
1. Forwardevent

52. 53
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
Event Stream Generator
ProcessState Agent
1. Forwardevent
2. Encryptevent with the
last provisioning key
Encryption
Provisioning Key
eTRzcO7/
ytjXqHTA
CBewLIXZ
ncb+4fk3
n

53. 54
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
Event Stream Generator
ProcessState Agent
1. Forwardevent
Encryption
Provisioning Key
eTRzcO7/
ytjXqHTA
CBewLIXZ
ncb+4fk3
n
3 . Transmit
encryptedevent
n/
2. Encryptevent with the
last provisioning key

54. 55
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
Event Stream Generator
ProcessState Agent
1. Forwardevent
Encryption
Provisioning Key
eTRzcO7/
ytjXqHTA
CBewLIXZ
ncb+4fk3
n
3 . Transmit
encryptedevent
n/
4. Decryptevent
with provisioning key
Decryption
43 61 73 65
3a 20 43 61
73 65 41 0a
2. Encryptevent with the
last provisioning key

55. 56
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
Event Stream Generator
ProcessState Agent
1. Forwardevent
Encryption
Provisioning Key
eTRzcO7/
ytjXqHTA
CBewLIXZ
ncb+4fk3
n
3 . Transmit
encryptedevent
Decryption
43 61 73 65
3a 20 43 61
73 65 41 0a
Extraction
Extraction
manifest
5. Extractevent
n/
2. Encryptevent with the
last provisioning key
4. Decryptevent
with provisioning key

56. 57
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
ProcessState Manager
FIFO queue
6. Pushevent

57. 58
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
n
Subscribed
ProMTEEprotocol
Event Dispatcher
ProcessState Manager
FIFO queue
6. Pushevent
7. Pop event

58. 59
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Control Flow Field Business Rule Field
Case P024#1
Status: Running
Secret Section
Enabled: FillIn Container
Case P024#1
Accessiblesection
Event e
ProcessStatePs
ExtractionmanifestEm
Status: -
Rule: Separationof duty (C3)

59. 60
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Secret Section
Accessiblesection
h
ProcessStatePs
e
=hash(
(=2f7e19af922e44056e0b33
4afc63ced4046c332bc02
94e3fe9aa3cd55305c3b7
Control Flow Field Business Rule Field
Case P024#1
Status: Running
Enabled: FillIn Container
Case P024#1
Status: -
Rule: Separationof duty (C3)

60. 61
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Secret Section
Accessiblesection
ProcessStatePs
Control Flow Field Business Rule Field
Case P024#1
Status: Running
Enabled: FillIn Container
Case P024#1
Status: -
Rule: Separationof duty (C3)

61. 62
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Secret Section
Accessiblesection
ProcessStatePs
Compliance Rule Tracker
Upds
Ps Ps’
update
Control Flow Field Business Rule Field
Case P024#1
Status: Running
Enabled: FillIn Container
Case P024#1
Status: TemporarilySatisfied
Rule: Separationof duty (C3)

62. 63
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Control Flow Field Business Rule Field
Secret Section
Accessiblesection
ProcessStatePs
evd=
Case P024#1
Status: Running
Enabled: FillIn Container
Case P024#1
Rule: Separationof duty (C3)
Status: TemporarilySatisfied

63. 64
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Control Flow Field Business Rule Field
Secret Section
Accessiblesection
ProcessStatePs
Case P024#1
Status: Running
Enabled: FillIn Container
Case P024#1
Rule: Separationof duty (C3)
Status: TemporarilySatisfied
<<executionenvironment>>
TrustedExecutionEnvironment
ProcessVault
<<executionenvironment>>
OS
ProcessVaultInspector
2024-11-04
T16:05:06
2f7e19af922e44
056e0b334afc6
3ced4046c332
bc0294e3fe9aa
3cd55305c3b7
upd now h
e
evd

64. 65
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Control Flow Field Business Rule Field
Secret Section
Accessiblesection
ProcessStatePs
Case P024#1
Status: Running
Enabled: Check Container
Case P024#1
Rule: Separationof duty (C3)
Status: TemporarilySatisfied

65. 66
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
Control Flow Field Business Rule Field
Secret Section
Accessiblesection
ProcessStatePs
Fillin Container Check Container
<event>
<string key=‘case:concept:name’ value=‘PO24#1’/>
<string key=‘concept:name’ value=‘Fill in Container’/>
<string key=‘Logistics Operator’ value= ‘A12B8L123’/>
</event>
Case P024#1
Status: Running
Case P024#1
Rule: Separationof duty (C3)
Enabled: Check Container Status: TemporarilySatisfied

66. 67
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
<<executionenvironment>>
OS
ProcessVaultInspector
Control Flow Field Business Rule Field
Case P024#1
Status: Running
Enabled: Check Container
Case P024#1
Status: TemporarilySatisfied
Rule: Separationof duty (C3)
Accessiblesection
Timestamp: 2024-11-04 T16:05:06
Event hash: 2f7e19af922e4193hd
Evidence: xvxnewosh2i793qdw
Timestamp: 2024-11-04 T16:05:06
Event hash:2f7e19af922e4193hd
Evidence: dwijwdwdpijdda12ds
<<device>>
Monitor Machine
<<device>>
Client Machine
ProcessState Agent
Data access
State inspection

67. 68
Bootstrapping
Trusted
subscription
Secure event
transmission
State update
21 3 4
ProMTEEprotocol
<<executionenvironment>>
OS
ProcessVaultInspector
Control Flow Field Business Rule Field
Case P024#1
Status: Running
Enabled: Check Container
Case P024#1
Status: TemporarilySatisfied
Rule: Separationof duty (C3)
Accessiblesection
Timestamp: 2024-11-04 T16:05:06
Event hash: 2f7e19af922e4193hd
Evidence: xvxnewosh2i793qdw
Timestamp: 2024-11-04 T16:05:06
Event hash:2f7e19af922e4193hd
Evidence: dwijwdwdpijdda12ds
<<device>>
Monitor Machine
<<device>>
Client Machine
ProcessState Agent
Data access
State inspection

68. Evaluation
69

69. 70
Evaluation
Security assesment
Threatanalysis
Performance analysis
Memory usage Responsiveness
(in the paper) (nextslides)

70. 71
Implementationdetails
ProcessVaultimplementedasan
Intel SGX trustedapplication
CPU: Intel Xeon Gold 5415+
We bootstrap our Process Vault
prototype using a Python encoding
of the Process Vault Compiler
Repository DOI: 10.5281/zenodo.15545155

71. 72
Experimentalsetting
Event log Type Cases Events Activities Businesrules
Supply Chain (SC)
Sepsis
BPIC12
Road Traffic Fines (RTF)
Synthetic
Real-world
Real-world
Real-world
2 000
1 050
13 087
150 370
40 740
15 214
262 200
561 470
19
16
36
11
5
2
16
8

72. 74
Memory usage
In-clearCPU-encrypted
TEE-enabled
CPU
DRAM
Trustedapp
Limited space

73. 75
Responsiveness
ൗ
&#3627409158;
&#3627409159;
Wemodel the event
fetchingand processing
withinthe ProcessVault
asan M/M/1 queue
Arrivalrate
Service rate
Occupationrate Expectedlag
eeee
1234
Event
Dispatcher
ProcessState
Manager
&#3627409159;−&#3627409158;
−1

74. 76
Responsiveness
ൗ
&#3627409158;
&#3627409159;
Occupationrate Expectedlag
&#3627409159;−&#3627409158;
−1

75. 77
Responsiveness
ൗ
&#3627409158;
&#3627409159;
Occupationrate Expectedlag
&#3627409159;−&#3627409158;
−1

76. 78
Responsiveness
ൗ
&#3627409158;
&#3627409159;
Occupationrate Expectedlag
&#3627409159;−&#3627409158;
−1

77. 79
Responsiveness
ൗ
&#3627409158;
&#3627409159;
Occupationrate Expectedlag
&#3627409159;−&#3627409158;
−1

78. 80
Responsiveness
ൗ
&#3627409158;
&#3627409159;
Occupationrate Expectedlag
&#3627409159;−&#3627409158;
−1

79. Future work
81

80. 82
Future work
Extension to the cross-instancedimension
The samelogisticsoperator must
appearin atleast3 process
instanceswithinthe sameday
Cross-instancebusiness rule

81. 83
Future work
Correctnesscheck with partiallyor
totallyundisclosedspecifications

82. 84
Future work
Consistencyacrossmultiple ProcessVaults
ProcessVault
ProcessVault
ProcessVault

83. 85
More in the paper

84. 86
SecrecyPreservationfor Online Process
Monitoring with TrustedExecution
Environment
ProMTEErepository
Claudio Di Ciccio, Utrecht University, Netherlands
Davide Basile, Sapienza University of Rome, Italy
[email protected]
[email protected]