Trusted Execution Environment for Decentralized Process Mining

Presentation of the paper "Trusted Execution Environment for Decentralized Process Mining" given during the CAiSE 2024 Conference in Cyprus on June 7, 2024.

1. Trusted Execution Environment for Decentralized Process Mining Valerio Goretti, Sapienza University of Rome Davide Basile, Sapienza University of Rome Luca Barbaro , Sapienza University of Rome – [email protected] Claudio Di Ciccio, Utrecht University

2. Outsourcing or not, that is the question 2

3. Outsourcing or not, that is the question 3

4. Decentralized process mining 4

5. Inter-organizational scenario 5

6. Inter- organizational scenario 6

7. Inter- organizational scenario 7

8. Inter- organizational scenario 8

9. Inter- organizational scenario 9

10. Inter- organizational scenario 10

11. Inter- organizational scenario 11

12. Inter- organizational scenario 12

13. Inter- organizational scenario 13

14. Inter- organizational scenario 14

15. Inter- organizational scenario 15

16. Inter- organizational scenario 16

17. Inter- organizational scenario 17

18. Inter- organizational scenario 18

19. Inter-organizational scenario National Institute of Statistics University 19

20. Confidential computing 20 Outsourcing of the event log introduces critical issues in terms of data secrecy What if the University disclose Alice’s hospitalization data with unauthorized parties ?

21. 21 “ Confidential Computing is the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment .” Confidential Computing Consortium Confidential computing

22. Our Requirements Organizational autonomy No fixed roles No event log alteration or abstraction No computational synchronization 22

23. No event log alteration or abstraction Results derived directly from the original information source No computational synchronization 23 Organizational autonomy No fixed roles

24. Once the logs are loaded, are then processed by a single machine No computational synchronization Organizational autonomy 24

25. Organizational autonomy Each participating organization retains the discretion to choose when and how mining operations are conducted No fixed roles 25

26. No fixed roles Peer-to-peer scenario in which organizations can simultaneously be data provisioners or miners 26

27. CONFINE Architecture 27

28. Log Recorder Secure Miner Node Node Secure Miner Node Event Log Exchange Node Provisioner Secure Miner Provisioner 28 High-level architecture

29. Miner Node Node Secure Miner Node Provisioner Node 29 Provisioner Secure Miner High-level architecture

30. Operating System PAIS Log Server Provisioner Node Provisioner Log Recorder Log Provider 30 Provisioner architecture Miner Node Secure Miner

31. Provisioner Node Operating System P.A.I.S. Log Server Execution environment: Data transfer 31 Provisioner Log Recorder Log Provider Provisioner deployment Miner Node Provisioner Secure Miner Log Receiver Log Manager Log Elaborator Log Requester

32. Miner Node Provisioner Secure Miner Log Receiver Log Manager Log Elaborator Log Requester 32 Miner architecture Provisioner Node Provisioner Operating System P.A.I.S. Log Server Execution environment: Data transfer 32 Provisioner Log Recorder Log Provider

33. Miner Node Provisioner Secure Miner Log Receiver Log Manager Log Elaborator Log Requester 33 Miner architecture Trusted Execution Environment Trusted App Event Log Data Execution environment:

34. Miner deployment 34 Miner Node Secure Miner Log Receiver Log Manager Log Elaborator Log Requester Trusted Execution Environment Trusted App Event Log Data Execution environment: Operating System TEE Interface Execution environment Method invocation

35. Miner Node Deployment Provisioner Node Provisioner P.A.I.S. Log Server Trusted Execution Environment Event Log Data Operating System TEE Interface Execution environment Execution environment Execution environment Operating System Trusted App Data transfer Method invocation Web communication 35 Secure Miner Log Receiver Log Manager Log Elaborator Log Requester

36. The CONFINE Protocol 36

37. Protocol Phases 37 Initialization Remote Attestation Data Transmission Computation Initialization Data Transmission Computation Remote Attestation

38. 38 Initialization Data Transmission Computation Remote Attestation Request c ases r eferences Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester Trusted Execution Environment Log Server: Log Provider

39. 39 Initialization Data Transmission Computation Remote Attestation Request c ases r eferences Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester Identify miner Trusted Execution Environment Log Server: Log Provider

40. 40 Initialization Data Transmission Computation Remote Attestation Request c ases r eferences Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester PAIS: Log Recorder Identify miner Access event log Trusted Execution Environment Log Server: Log Provider

41. 41 Initialization Data Transmission Computation Remote Attestation Request c ases r eferences Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester PAIS: Log Recorder Identify miner Access event log Send event log Trusted Execution Environment Log Server: Log Provider

42. 42 Initialization Data Transmission Computation Remote Attestation Request c ases r eferences Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester PAIS: Log Recorder Identify miner Access event log Send event log Send cases r eferences Trusted Execution Environment Log Server: Log Provider

43. Miner Node 43 Initialization Data Transmission Computation Remote Attestation TEE Request c ases Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester Trusted Execution Environment Log Server: Log Provider

44. Miner Node 44 Initialization Data Transmission Computation Remote Attestation TEE Request c ases Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester Trusted Execution Environment Request attestation data Log Receiver Log Server: Log Provider

45. Miner Node 45 Initialization Data Transmission Computation Remote Attestation TEE Request c ases Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester Trusted Execution Environment Request attestation data Log Receiver Send report Log Server: Log Provider

46. Miner Node 46 Initialization Data Transmission Computation Remote Attestation TEE Request c ases Provisioner Node Miner Node TEE Trusted App: Secure Miner Log Requester Trusted Execution Environment Request attestation data Log Receiver Send report Identify miner and verify report Log Server: Log Provider

47. 47 Initialization Data Transmission Computation Remote Attestation TEE Provisioner Node Miner Node TEE Trusted App: Secure Miner Trusted Execution Environment PAIS: Log Recorder Access event log Log Server: Log Provider Log Receiver

48. 48 Initialization Data Transmission Computation Remote Attestation TEE Provisioner Node Miner Node TEE Trusted App: Secure Miner Trusted Execution Environment PAIS: Log Recorder Access event log Send event log Log Server: Log Provider Log Receiver

49. 49 Initialization Data Transmission Computation Remote Attestation TEE Provisioner Node Miner Node TEE Trusted App: Secure Miner Trusted Execution Environment PAIS: Log Recorder Generate segments Access event log Send event log Log Server: Log Provider Log Receiver

50. 50 Initialization Data Transmission Computation Remote Attestation TEE Provisioner Node Miner Node TEE Trusted App: Secure Miner Trusted Execution Environment PAIS: Log Recorder Generate segments Access event log Send event log Send encrypted segments Log Server: Log Provider Log Receiver

51. 51 Initialization Data Transmission Computation Remote Attestation Provisioner Node Miner Node TEE PAIS: Log Recorder Generate segments Access event log Send event log Send encrypted segments Log Server: Log Provider Trusted App: Secure Miner Trusted Execution Environment Log Receiver Decrypt segment

52. 52 Initialization Data Transmission Computation Remote Attestation Provisioner Node Miner Node TEE PAIS: Log Recorder Generate segments Access event log Send event log Send encrypted segments Log Server: Log Provider Trusted App: Secure Miner Trusted Execution Environment Log Receiver Decrypt segment Forward segment cases Log Manager

53. Provisioner Node Miner Node TEE PAIS: Log Recorder Generate segments Access event log Send event log Send encrypted segments Log Server: Log Provider Trusted App: Secure Miner Trusted Execution Environment Log Receiver Decrypt segment Forward segment cases Log Manager Merge and store 53 Initialization Data Transmission Computation Remote Attestation

54. Miner Node Miner Node Trusted App: Secure Miner Trusted Execution Environment Log Manager Forward merged cases Log Elaborator 54 Initialization Data Transmission Computation Remote Attestation

55. Miner Node 55 Initialization Data Transmission Computation Miner Node Miner Node Trusted App: Secure Miner Trusted Execution Environment Log Manager Forward merged cases Operating System Log Elaborator Run mining algorithm Remote Attestation

56. Miner Node 56 Initialization Data Transmission Computation Miner Node Miner Node Trusted App: Secure Miner Trusted Execution Environment Log Manager Forward merged cases Operating System Log Elaborator Run mining algorithm Remote Attestation Operating System TEE Interface result Return

57. Evaluation 57

58. 58 Name Type Activities Cases Max events Min events Avg events Parties Motivating scenario Synthetic 19 1000 18 9 14 3 Sepsis Real 16 1050 185 3 15 3 BPIC 2013 Real 7 1487 123 1 9 3 Event Logs

59. Memory Usage 59

60. Memory Usage 60

61. Memory Usage 61

62. Memory Usage 62

63. Memory Usage 63

64. Memory Usage 64

65. Memory Usage 65

66. Scalability 66

67. Scalability 67

68. Future Work 68

69. Clock synch Future Work More algorithms integration Utilization rules 69 Agreement on case identification

70. https:// github.com / Process -in-Chains/CONFINE Trusted Execution Environment for Decentralized Process Mining Valerio Goretti, Sapienza University of Rome Davide Basile, Sapienza University of Rome Luca Barbaro , Sapienza University of Rome Claudio Di Ciccio, Utrecht University