Privacy-Preserving Process Model Discovery Using Fully Homomorphic and Quantum-Safe Encryption

Abstract

Process mining is a data-driven technique that acts as a bridge between data science and process management. One of its main tasks is enabling the identification of process models from event logs. However, when event logs contain sensitive data or compliance with data protection regulations is required, privacy concerns arise. To address these issues, we propose a novel process discovery method that ensures data confidentiality under an honest-but-curious scenario. Our method is the first to leverage Ring Learning With Errors (RLWE)-based encryption for process discovery, enabling computations over quantum-resistant encrypted data. Unlike existing cryptographic approaches for Privacy-Preserving Process Discovery (PPPD), the proposed method uses fully homomorphic and RLWE-based encryption to execute the required computations over ciphertexts while preserving the quality of the discovered process models. This leads to a significant reduction in execution time compared to other PPPD approaches. We evaluated our method using real-life event logs commonly employed to evaluate process discovery algorithms. The results demonstrate improved performance and enhanced privacy compared to prior approaches. This contribution represents a substantial advancement in PPPD, laying the foundation for a secure and feasible cryptographic framework.

1. Introduction

Business processes are structured sequences of activities designed to achieve specific organizational goals across domains such as healthcare, government, and industry [1]. Their execution generates logs, which serve as valuable resources for analysis and process improvement. Business processes have increasingly attracted research interest in areas such as digital transformation, process automation, and secure data analytics [2,3,4,5,6,7].

A business process executed on an Enterprise Resource Planning (ERP) system is typically carried out multiple times, with each execution instance referred to as a case (Case ID). Each case consists of a sequence of events generated during the execution of process activities (Activity), forming what is known as a trace. Traces are stored in a structured format within an event log. Table 1 presents an example of an event log from a healthcare-related business process, containing seven events distributed across three process cases. Each row represents a single event, and columns correspond to the attributes associated with that event.

Table 1. Event log in the context of a business process in the health domain.

Case ID	Timestamp	Activity	Resource	Cost	Age	Diagnosis
1	01-01-2018 15:20:15	Register	Paolo	1000	42	Diabetes
1	01-01-2018 15:22:02	Triage	Frank	100	42	Diabetes
2	01-01-2018 15:43:08	Register	Monica	1000	21	Infection
2	01-01-2018 15:43:50	X-Rays	Joey	100	21	Infection
1	01-01-2018 15:45:43	Blood Test	Paolo	50	42	Diabetes
3	01-01-2018 15:46:27	Register	Frank	1000	28	Schizophrenia
3	01-01-2018 15:48:14	Triage	Frank	100	28	Schizophrenia
…	…	…	…	…	…	…

Event-log data provide valuable insights into the actual behavior of the corresponding business process, as opposed to its idealized functioning. This insight forms the foundation of process mining [8], a discipline at the intersection of data science and business process management. Process mining aims to extract actionable knowledge from event logs recorded by information systems to discover, monitor conformance, and improve business processes.

Process model discovery [9] is one of the three main tasks in process mining. It aims at uncovering the real behavior of a process, assessing its deviations from the recorded event log, and identifying opportunities for optimization. Process model discovery has been an active research topic within process mining [9,10,11,12,13], focusing on deriving accurate models from event logs based on the behavior reflected therein. These discovered models are crucial for identifying errors in the process, detecting bottlenecks, and optimizing the respective business workflows.

Process mining applications span multiple domains [14]. In financial auditing, process mining supports risk identification, compliance verification, and internal control evaluation. In healthcare, it contributes to reducing patient waiting times and improving care quality through more efficient clinical workflows [15]. In robotic process automation, it facilitates the discovery and aggregation of automation routines [16].

Leveraging an untrusted third party [2] for process mining services is particularly attractive for: (1) organizations to analyze and optimize their business processes without the use of complex on-premise deployments; (2) making process mining accessible to non-experts. However, in domains involving sensitive data in the event log, such as in healthcare (e.g., patient information, diagnoses, or treatments), significant challenges arise to share the event logs with an external provider, which generally behaves as an untrusted third party that follows the honest-but-curious adversarial model [17,18,19]. In such scenarios, protecting the event log is essential, particularly in contexts where strict data privacy regulations apply, such as the General Data Protection Regulation [20]. A clear example is shown in Table 1: the Resource attribute may directly identify employees or healthcare personnel, whereas Age, exact Timestamp, Cost, and Diagnosis can act as quasi-identifiers or sensitive attributes [2]. Even when the Case ID is pseudonymized, it allows all events belonging to the same process instance to be linked, thereby revealing the complete sequence of activities associated with an individual case. Combinations such as a diagnosis, age, treatment sequence, and precise timestamp may enable re-identification when they are linked with external information [19].

While traditional process discovery algorithms effectively extract process models from event logs with data in clear, they fail to preserve privacy if the data are sensitive. Privacy-Preserving Process Discovery (PPPD) techniques often rely on data anonymization methods, such as generalization, suppression, or differential privacy [21,22], to reduce the risk of exposing identifiable information. However, these approaches typically introduce a trade-off between privacy and model accuracy, as they may distort the event-log structure, leading to incomplete or imprecise process models. Moreover, anonymization on its own is not always sufficient to meet stringent privacy requirements, particularly in scenarios involving regulatory compliance or highly sensitive data.

The use of cryptographic frameworks has been another known approach in the literature to maintain the utility of data in process mining tasks when dealing with sensitive information [17,19,23]. Often, deterministic encryption is used for categorical attributes in event logs, while homomorphic encryption is generally applied to numeric attributes. Studies in [17,19] demonstrated that encryption has a minimal impact on the utility of event-log data for process model discovery compared to other privacy-preserving techniques in data mining, such as data sharing, generalization, or noise addition. However, encryption has been relatively unattractive for preserving data privacy in process mining because most cryptographic schemes rely on deterministic encryption, which enables a wide range of data leakage attacks [19]. Even with encrypted event logs, an entity with access to certain data and some knowledge of the business process may use deanonymization techniques [24] to uncover confidential information. Therefore, for process mining tasks like process discovery, simply encrypting the event log is insufficient. It is also crucial to implement techniques that protect against attackers with knowledge of the business process context, while still preserving data utility.

Homomorphic encryption (HE) [25] is a cryptographic technique that allows computations directly on encrypted data, generating encrypted results that can be decrypted only by authorized parties [26]. This property enables secure data processing without exposing sensitive information. Additionally, certain HE schemes use non-deterministic encryption techniques to ensure semantic security, a property whereby the encryption of the same plaintext produces different ciphertexts, making it computationally infeasible for an attacker to infer any meaningful information about the plaintext from the ciphertext, preventing chosen-plaintext attacks [27]. HE has been explored in the context of process mining as a privacy-preserving approach for process discovery [17,18,23].

Prior cryptographic approaches for PPPD have used Partially Homomorphic Encryption (PHE), such as the Paillier cryptosystem [26], a PHE cryptosystem that supports only a homomorphic addition to entirely encrypt the event log [18]. While PHE enables certain secure computations, it introduces a significant limitation. However, these approaches generally require additional secure protocols or interactions to perform operations not directly supported by the underlying cryptosystem. To overcome these limitations, Fully Homomorphic Encryption (FHE) [28] enables complex operations on encrypted data without requiring intermediate decryption. This capability allows for the secure outsourcing of computations, such as those involved in data science or machine learning.

This paper presents Alpha-PQC, a novel PPPD algorithm that operates directly on fully homomorphic, quantum-safe encrypted event logs. FHE enables performing nearly all computations by the external entity without the need for secure computation protocols with the data owner. Consequently, the impact of the event-log size on processing time is significantly reduced compared to traditional approaches.

Our method supports accurate and feasible process discovery without relying on interactive homomorphic protocols for specific operations. This architectural choice positions Alpha-PQC as a highly and secure solution for delegating computational tasks to an external party, making it particularly well-suited for environments involving honest-but-curious service providers. The FHE scheme employed is grounded in the RLWE problem [29], ensuring strong security guarantees against both classical and quantum adversaries. To the best of our knowledge, Alpha-PQC is the first method to leverage FHE for quantum-safe process model discovery.

Alpha-PQC was evaluated using the real-life event logs Sepsis Cases [30], Healthcare Treatment [31], Hospital Billing [32], Road Traffic Fines [33] and BPIC 2019 [34]. The performance was assessed by obtaining the execution times of the algorithms, which were then used for comparison against previous schemes. Notably, Alpha-PQC achieved an average reduction of approximately $46.8\%$, corresponding to an average $2.07$ speedup over AlphaSec, demonstrating enhanced efficiency while maintaining post-quantum security. Furthermore, utility loss was evaluated using four conformance checking metrics, and Alpha-PQC preserves the fidelity of the resulting process models, yielding models that are equivalent to those obtained with the original Alpha algorithm without security mechanisms.

The remainder of this paper is structured as follows: Section 2 presents background about process model discovery and data FHE. Section 3 reviews related work in process discovery and PPPD. Section 4 presents the design and architecture of our proposed algorithm. Section 5 describes the experimental setup and evaluates the algorithm’s performance. Finally, Section 6 discusses the strengths, limitations, and potential future directions of this research.

2. Background

This section introduces key concepts and notation used throughout this paper.

2.1. System Model

This work focuses on the protection and analysis of event logs in external environments, where organizations may lack the necessary resources for local processing and, therefore, rely on either an untrusted party or internal analysts who are not directly involved in the business process itself.

Figure 1 illustrates the scenario of interest in this work: a setting in which organizations (data owner) executing a business process through an ERP system outsource the resulting protected event log using a cryptographic framework to an external untrusted party. The applied privacy-preserving solution ensures semantic security while maintaining the utility of the data for process discovery tasks. The untrusted party performs process discovery over the protected event log, and within the organization, the process manager analyzes the discovered model privately to enhance the business process as part of the process mining workflow.

Figure 1. PPPD scenario for process discovery.

2.2. Process Discovery

To formally describe process discovery, it is necessary to define the structure and components of an event log, which captures the execution of process activities over time.

Event Log

An event log [35] is formally defined as follows: Let $\mathcal{A}$ denote the set of all activities performed in a business process. An event e corresponds to the occurrence of an activity, such that $e\in \mathcal{A}$. A trace t is a sequence of events: $t\in {\mathcal{A}}^{\ast }$. The set ${\mathcal{A}}^{\ast }$ represents all possible sequences of activities in $\mathcal{A}$. An event log L is a non-empty finite multiset of traces, representing business process instances: $L\subseteq {\mathcal{A}}^{\ast }$. For example, $\{⟨a,b,c⟩,⟨a,c,b⟩\}$ represents a log with two traces, $⟨a,b,c⟩$ and $⟨a,c,b⟩$, where in the first trace, the events occur in the order of a, then b, and finally c.

The events are associated with a Case ID and generated by an Activity executed at a specific date and time Timestamp by a Resource of the process, as illustrated in Table 1. The whole set of cases in L represents the real behavior of the business process. A trace is the (non-unique) chronological sequence of events (represented by the activity) for a given case. The event log in Table 1 has three distinct traces: $⟨\mathtt{Register},\mathtt{Triage},\mathtt{Blood Test}⟩$, $⟨\mathtt{Register},\mathtt{X}-\mathtt{Rays}⟩$, and $⟨\mathtt{Register},\mathtt{Triage}⟩$.

The discovery of process models from an event log is one of the most widely studied tasks in process mining, explored from various approaches and using different notations. Examples of process discovery algorithms include the Alpha ($\alpha$-algorithm) [36], which originally discovers models in Petri Nets (PNs); and Split Miner [37], which uncovers models in BPMN. Both algorithms use a Directly-Follows Graph (DFG) model as the starting point for the discovery process. DFGs are lightweight models that capture the directly-follows relations between activities in an event log, but they cannot represent control-flow constructs such as logic gates (e.g., parallelism, choice, or synchronization) as PN or BPMN models can. Figure 2 shows the process model discovered from the event log presented in Table 1, using the Alpha algorithm.

Figure 2. Process model corresponding to the event log in Table 1.

The Alpha algorithm [36] is one of the first algorithms for process model discovery. It takes an event log L as input and produces a process model M in PN. Let us use the next event log as an example: $L=\{⟨a,b,e,f⟩,⟨a,b,e,c,d,b,f⟩,⟨a,b,c,e,d,b,f⟩,$$⟨a,b,c,d,e,b,f⟩,⟨a,e,b,c,d,b,f⟩\}$. The Alpha process model discovery algorithm works as follows:

• Identifies the set of distinct activities ($\mathcal{A}$) in L: $\mathcal{A}=\{⟨a,b,c,d,e,f⟩\}$.
• Discovers the initial activities (${\mathcal{A}}^I$) on each $t_j$: ${\mathcal{A}}^I=\left\{a\right\}$.
• Discovers the final activities (${\mathcal{A}}^O$) on each $t_j$: ${\mathcal{A}}^O=\left\{f\right\}$.
• Groups activities using order relationships, causality (→), parallelism ($\left|\right|$), and choice (#), to create the set of relations $X_L$, where $X_L=\{(\left\{a\right\},\left\{b\right\}),(\left\{a\right\},\left\{e\right\}),(\left\{b\right\},\left\{c\right\}),$$\left(\right\{b\},\{f\left\}\right),\left(\right\{c\},\{d\left\}\right),\left(\right\{d\},\{b\left\}\right),$$\left(\right\{e\},\{f\left\}\right),\left(\right\{a,d\},\{b\left\}\right),\left(\right\{b\},\{c,f\left\}\right)\}$.
• Redundant elements are removed from $X_L$ to create an optimized set of relationships $Y_L=\{(\left\{a\right\},\left\{e\right\}),(\left\{c\right\},\left\{d\right\}),(\left\{e\right\},\left\{f\right\}),$$\left(\right\{a,d\},\{b\left\}\right),$$\left(\right\{b\},\{c,f\left\}\right)\}$.
• Determines the set of nodes ($\lambda$) and the start and end nodes ($M^I,M^O$) of the model, where $\lambda =\{p_{\left(\right\{a\},\{e\left\}\right)},$$p_{\left(\right\{c\},\{d\left\}\right)},$$p_{\left(\right\{e\},\{f\left\}\right)},$$p_{\left(\right\{a,d\},\{b\left\}\right)},p_{\left(\right\{b\},\{c,f\left\}\right)},M^I,M^O\}$.
• Connects nodes $\lambda$ through arcs $\gamma$, where $\gamma =\{(M^I,a),(f,M^O),(a,p_{\left(\right\{a\},\{e\left\}\right)}),$$(p_{\left(\right\{a\},\{e\left\}\right)},e),$$(c,p_{\left(\right\{c\},\{d\left\}\right)}),$$\dots ,$$(p_{\left(\right\{b\},\{c,f\left\}\right)},c),$$(p_{\left(\right\{b\},\{c,f\left\}\right)},f)\}$.
• Return $\alpha$(L) as a PN, which is represented by the triad ($\lambda ,\mathcal{A},\gamma$).

2.3. Fully Homomorphic Encryption

Encryption is commonly used to ensure the confidentiality and privacy of data. A cipher, denoted in this paper as $\mathcal{C}$, consists of the three following components: ${\mathcal{K}}_g,\mathcal{E},\mathcal{D}$:

-

${\mathcal{K}}_g\left(1^n\right)$: generates a pair of keys, $k^{\mathcal{E}}$ (encryption key) and $k^{\mathcal{D}}$ (decryption key), based on a security parameter $1^n$.

-

$\mathcal{E}(m,k^{\mathcal{E}})$: transforms a plaintext message m into an encrypted ciphertext $\left[m\right]$ (which is unreadable) using the encryption key $k^{\mathcal{E}}$.

-

$\mathcal{D}(\left[m\right],k^{\mathcal{D}})$: allows the decryption of $\left[m\right]$ back into the original message m using the corresponding decryption key $k^{\mathcal{D}}$.

It is crucial to note that a ciphertext $\left[m\right]$ has no inherent meaning, and it is nearly impossible for an unauthorized third party to recover the original message m from $\left[m\right]$ without the decryption key $k^{\mathcal{D}}$. Therefore, the security of encryption largely depends on the strength of the keys.

Encryption has been applied in process mining, with various types of ciphers considered, including:

• Symmetric encryption: $k^{\mathcal{E}}=k^{\mathcal{D}}$ [23].
• Asymmetric encryption: $k^{\mathcal{E}}=f\left(k^{\mathcal{D}}\right)$, where f is a one-way function [18].
• Deterministic encryption: where if $m_1=m_2$ then $\mathcal{E}(m_1,k^{\mathcal{E}})=\mathcal{E}(m_2,k^{\mathcal{E}})$ [17].
• Non-deterministic encryption: where if $m_1=m_2$ then $\mathcal{E}(m_1,k^{\mathcal{E}})\ne \mathcal{E}(m_2,k^{\mathcal{E}})$ [18].
• Homomorphic encryption: $\mathcal{D}\left(\left[\mathcal{E}(m_1,k^{\mathcal{E}})\circ \mathcal{E}(m_2,k^{\mathcal{E}})\right],k^{\mathcal{D}}\right)=(m_1\square m_2)$, where □ and ∘ are binary operators for plaintext and encrypted data, respectively [18].

Homomorphic Encryption (HE) is particularly significant because, when the encrypted result is decrypted, it yields the same outcome as if the operations had been performed directly on the plaintext. This property makes such encryption schemes highly attractive for data analytics tasks, as done in this paper in the context of process mining. However, its applicability strongly depends on the types of operators supported. For instance, process discovery algorithms require computations such as equality checking and multiplication over encrypted values. If these operators are not supported by the underlying homomorphic encryption scheme (executed by the untrusted party), they must be offloaded to the data owner. In such cases, the data owner decrypts the relevant values, performs the operation locally, re-encrypts the result, and sends it back to the service provider, who then continues the processing in the encrypted domain. In PHE settings, operations not supported by the cryptosystem, such as equality checking or multiplication, typically require auxiliary secure protocols or interaction with the data owner [38,39].

FHE [40] is a specific type of homomorphic encryption that enables an arbitrary number of dynamically chosen computations to be performed on ciphertexts. This capability greatly reduces the processing time by removing the interaction between the data owner and the untrusted party.

RLWE-Based Non-Deterministic Fully Homomorphic Encryption

Brakerski/Fan-Vercauteren (BFV) [41] is an RLWE-based, non-deterministic, fully homomorphic public-key cryptosystem defined as follows:

Let $\kappa$ denote the security parameter. The scheme is parameterized by a prime number q, a prime element $t\in {\mathbb{Z}}_q^{\ast }$, an irreducible polynomial $f\left(x\right)\in \mathbb{Z}\left[x\right]$ of degree n, and an error distribution $\chi$ over the ring $R_q={\mathbb{Z}}_q\left[x\right]/⟨f\left(x\right)⟩$. The ciphertext $\left[m\right]modq$, a plaintext $mmodt$. The parameters $n,f\left(x\right),q$, and $\chi$ are public. Define $R_t={\mathbb{Z}}_t\left[x\right]/⟨f\left(x\right)⟩$ and the scaling factor $\Delta =\lfloor q/t\rfloor$.

• Key Generation, ${\mathcal{K}}_g\left(\kappa \right)$: Sample $s\stackrel{\$}{\leftarrow }\chi$, $a\stackrel{\$}{\leftarrow }{R}_q$, and $e\stackrel{\$}{\leftarrow }\chi$. Set the secret key $k^{\mathcal{D}}=s$ and the public key $k^{\mathcal{E}}=(a,b=-as+e)$.
• Encryption, $\mathcal{E}(k^{\mathcal{E}},m)$: The message space is $R_t$. Let $m\in R_t$ and lift it to $R_q$. Sample $u,e_1,e_2\stackrel{\$}{\leftarrow }\chi$. Compute

$${\left[m\right]}_0=b·u+e_1+\Delta m\in R_q,{\left[m\right]}_1=a·u+e_2\in R_q$$

and output the ciphertext $\left[m\right]=({\left[m\right]}_0,{\left[m\right]}_1)\in R_q^2$.

• Decryption, $\mathcal{D}(k^{\mathcal{D}},\left[m\right])$: Given $\left[m\right]=({\left[m\right]}_0,{\left[m\right]}_1)$, compute

$$v={\left[m\right]}_0+{\left[m\right]}_{1}s\in R_q$$

and recover the message as

$$\begin{array}{c}\hfill \begin{array}{c}\hfill m=⌊{\displaystyle \frac{t}{q}}·v⌉modt\end{array}\end{array}$$

This cryptographic scheme supports homomorphic operations. Specifically, the structure of the ciphertexts and the algebraic properties of the ring $R_q$ enable addition and multiplication over ciphertexts.

• Addition, $Add(\left[m\right],{\left[m\right]}^{\prime })$: Given two ciphertexts $\left[m\right]=({\left[m\right]}_0,{\left[m\right]}_1)$ and ${\left[m\right]}^{\prime }=({\left[m\right]}_0^{\prime },{\left[m\right]}_1^{\prime })$, output

$$\begin{array}{c}\hfill \begin{array}{c}\hfill {\left[m\right]}_{add}=({\left[m\right]}_0+{\left[m\right]}_0^{\prime },{\left[m\right]}_1+{\left[m\right]}_1^{\prime })\in R_q^2\end{array}\end{array}$$

Multiplication, $Mult(\left[m\right],{\left[m\right]}^{\prime })$: Given $\left[m\right]=({\left[m\right]}_0,{\left[m\right]}_1)$ and ${\left[m\right]}^{\prime }=({\left[m\right]}_0^{\prime },{\left[m\right]}_1^{\prime })$, compute

$$c_0^{\prime }={\left[m\right]}_0{\left[m\right]}_0^{\prime },c_1^{\prime }={\left[m\right]}_0{\left[m\right]}_1^{\prime }+{\left[m\right]}_1{\left[m\right]}_0^{\prime },c_2^{\prime }={\left[m\right]}_1{\left[m\right]}_1^{\prime }$$

then scale

$${\tilde{c}}_i=⌊{\displaystyle \frac{t}{q}}·c_i^{\prime }⌉$$

and output

$$\begin{array}{c}\hfill \begin{array}{c}\hfill {\left[m\right]}_{mult}=({\tilde{c}}_0,{\tilde{c}}_1,{\tilde{c}}_2)\in R_q^3\end{array}\end{array}$$

Since the degree of the resulting ciphertext increases, a relinearization procedure is applied to reduce the ciphertext back to size two. Using evaluation keys associated with $s^2$, the ciphertext is transformed as

$$({\tilde{c}}_0,{\tilde{c}}_1,{\tilde{c}}_2)\to ({\widehat{c}}_0,{\widehat{c}}_1)$$

thus preserving correctness while controlling ciphertext growth.

• Subtraction, $Sub(\left[m\right],{\left[m\right]}^{\prime })$: Given two ciphertexts $\left[m\right]=({\left[m\right]}_0,{\left[m\right]}_1)$ and ${\left[m\right]}^{\prime }=({\left[m\right]}_0^{\prime },{\left[m\right]}_1^{\prime })$, output

  $$\begin{array}{c}\hfill \begin{array}{c}\hfill {\left[m\right]}_{sub}=({\left[m\right]}_0-{\left[m\right]}_0^{\prime },{\left[m\right]}_1-{\left[m\right]}_1^{\prime })\in R_q^2\end{array}\end{array}$$

RLWE-based schemes such as BFV allow the encryption of modular integers, enabling the construction of equality tests over encrypted data without requiring access to the private key.

• Equality Check Test, $IsEqual(\left[m\right],{\left[m\right]}^{\prime })$: Let $\left[m\right]$ and $\left[m^{\prime }\right]$ be two ciphertexts. First, a homomorphic subtraction is performed: $\left[d\right]=Sub(\left[m\right],{\left[m\right]}^{\prime })=[m-m^{\prime }]$. The result $\left[d\right]$ encrypts 0 if $m=m^{\prime }$, and a non-zero value otherwise. Assuming that the $mmodt$ is prime, Fermat’s little theorem can be applied by computing $\left[e\right]={\left[d\right]}^{t-1}$, which yields an encryption of 0 when $d=0$, and 1 when $d\ne 0$. Finally, the result is inverted to obtain the equality indicator: $\left[\delta \right]=1-\left[e\right]$, where $\left[\delta \right]$ encrypts 1 if $m=m^{\prime }$, and 0 otherwise.

3. Related Work

This section reviews the literature on privacy-preserving methods designed to guarantee the confidentiality of event-log data and the privacy of individuals involved in cross-organizational business processes or external environments. The focus is on cryptographic-based frameworks and workflows [17,18,19,23,42,43,44,45] specifically developed for such purposes.

Burattin et al. (2015) [23] proposed one of the first cryptographic frameworks for PPPD. This framework applies different encryption types to various event-log attributes: a symmetric deterministic AES cryptosystem for text-based attributes, maintaining differentiation between encrypted texts for analysis, and homomorphic encryption using the PHE Paillier cryptosystem for numerical attributes, allowing certain plaintext operations on encrypted data. Tillem et al. (2017) [18] proposed AlphaSec, a cryptographic framework leveraging the PHE Paillier cryptosystem for process discovery using the Alpha algorithm on encrypted logs. AlphaSec modifies the Alpha algorithm to perform secure discovery directly on encrypted data. Rafiei et al. (2020) [17] proposed a framework with three security levels—prohibited, internal, and external—to provide graduated protection for event logs. Transitions between these levels involve two confidentiality mechanisms that allow partial data access for analysts, enabling the application of certain process discovery techniques while posing a risk of re-identification. In addition, it introduces a connector method that securely links events. This method ensures ciphertext differentiation, allowing the application of certain discovery algorithms while still preserving the confidentiality of the original data. Pika et al. (2020) [19] proposed a framework integrating anonymization techniques and deterministic encryption. It suggests including metadata in event logs to document privacy-preserving methods, enabling reversible protection for authorized users. The framework leverages the Extensible Event Stream (XES) format to incorporate metadata. Kazemian et al. (2023) [44] highlight the challenge of privacy-preserving process mining in large-scale digital business networks. They propose a lightweight encryption method based on the Haar transform with a private key to anonymize process logs, targeting scenarios with low computational complexity (such as 5G networks in IoT) designed to balance privacy with efficiency. Their evaluation shows that the proposed approach is more suitable for real-time industrial applications. De la Fuente (2024) [46] propose a two-phase cryptographic method: (1) Event-Log Privacy Preservation (ELPP), which encrypts the event log using a modified Paillier scheme and deterministic encryption for identifiers; (2) Process Model Access Control (PMAC), which leverages proxy re-encryption to manage access to the discovered model. The encrypted log is sent to a server that performs process discovery mining without loss of utility, producing an encrypted model. Through proxy re-encryption, only authorized users are able to decrypt the resulting model. Zhang et al. (2024) [45] addresses the problem of privacy in cross-organizational process mining, where logs from multiple organizations are combined to reconstruct collaborative business process models. The authors propose the use of blockchain and cryptography in a framework that ensures privacy through private model construction, secure intersection algorithms, and the generation of organization collaborative models. Table 2 summarizes the main characteristics of the reviewed PPPD approaches and compares them with our proposal.

Table 2. Qualitative comparison of existing works addressing the privacy-preserving concern in process discovery over encrypted event-log data.

Proposal	Perspective	Cryptosystem	SS	FHE	PHE	AC	PQC	UL	FV
[23]	CF/Org	AES/Paillier	×	×	✓	×	×	×	✓
[18]	CF	Paillier	✓	×	✓	×	×	×	×
[17]	CF/TC/Org	AES/Paillier	×	×	✓	×	×	×	×
[19]	CF/TC/Org	(deterministic)	×	×	×	×	×	✓	×
[44]	CF	Paillier	✓	×	✓	×	×	×	×
[46]	CF	Paillier	×	×	✓	✓	×	×	×
[45]	CF	(asymmetric)	✓	×	×	×	×	×	×
Our work	CF	RLWE	✓	✓	×	✓	✓	×	×

×: Not supported; ✓: Supported; CF: Control-Flow Analysis; FHE: Fully Homomorphic Encryption; AC: Access Control; Org: Organizational; TC: Time Case; PQC: Post-Quantum Cryptography; SS: Semantic Security; UL: Causes Utility Loss; PHE: Partial Homomorphic Encryption; FV: Frequency Analysis Vulnerability.

Discussion

Ensuring the confidentiality and privacy of an event log is mandatory if it is used for process mining tasks in an honest-but-curious scenario. Even before the creation of the first process mining algorithm [36], workflows [47,48] were already suggested to analyze collaborative business processes across multiple organizations. These, by utilizing trusted third-party entities, allowed for easy analysis in collaborative interorganizational scenarios with a variety of analytical perspectives. They focused solely on discovering a basic process model and its security based on trust in the third entity. It was not until the introduction of the first framework [23] that encryption began to be adopted to protect log data. These proposals also enabled analysis in interorganizational process scenarios for environments focused on common point exploitation. Works such as [17,19,46] propose frameworks that base their security on encryption to avoid the loss of utility of the data since the property of differentiation between encrypted texts is maintained. However, with the type of encryption they use (deterministic, AES), semantic security is not guaranteed, and they are vulnerable to chosen-plaintext attacks. Therefore, it has been observed that in the following studies [21,49,50,51], encryption has been abandoned for this problem, opting instead for techniques based on differential privacy (e.g., k-anonymity), balancing privacy, and the loss of data utility.

So far, Tillem’s work [18] was the first to use homomorphic operations to perform PPPD using a non-deterministic Paillier cryptosystem [26], which is a PHE scheme with limited homomorphic properties, specifically the addition of ciphertexts. Thus, the resulting secure protocols lead to a high interaction between the untrusted party and the data owner (for the data owner to execute operators over the decrypted partial results obtained by the untrusted party over encrypted data). Of course, this extends the processing times and reduces the efficiency of the discovery task. That is why an FHE (which has not been used in the presented methods) makes it possible to eliminate additional secure protocols to operate on encrypted data completely on the untrusted party side. By directly enabling all the required homomorphic operators over ciphertexts, FHE reduces the computational overhead and streamlines the process discovery task, providing a more efficient and practical solution while maintaining data security and utility. However, the cipher used in [18,44,46] (and in most proposals that use encryption) is a conventional public-key cryptosystem, which will be vulnerable to quantum computing attacks [52,53]. As far as is known, there are no works in this area that address post-quantum cryptography.

4. Proposed Privacy-Preserving Process Discovery Algorithm

This section presents our proposed PPPD solution under post-quantum conditions. We first describe the target scenario and security requirements, followed by the architectural design and detailed operational workflow of the proposed Alpha-PQC algorithm. Then, we provide a formal security analysis, highlighting the cryptographic guarantees and privacy-preserving properties of our method. Finally, we analyze the computational cost of Alpha-PQC in terms of the cryptographic and homomorphic operations required during the encrypted process discovery procedure.

4.1. Alpha-PQC Framework Design

The proposed Alpha-PQC algorithm adapts process discovery to a fully homomorphic and post-quantum cryptographic setting. It enables the required encrypted operations to be executed mainly by the untrusted party, without relying on PHE limitations. The main design goal is to support encrypted activity extraction and directly-follows detection through native homomorphic operations, reducing the need for interaction with the data owner during process discovery. The FHE scheme used is based on the RLWE problem, providing a quantum-safe security foundation against both classical and quantum adversaries. As a result, the need for interactive communication between the untrusted party and the data owner during the process discovery task is reduced to a single matrix decryption, thereby improving computational efficiency while ensuring strong privacy guarantees for the encrypted event log.

Figure 3 illustrates the overall architecture in which Alpha-PQC operates. The data owner first encrypts the event log within a secure environment using RLWE-based non-deterministic FHE. The encrypted log is then outsourced to an untrusted party, which executes the secure process model discovery algorithm, Alpha-PQC, directly on the encrypted data. The output is an encrypted process model, which the untrusted party returns to the end user (who may be the same entity as the data owner). The end user subsequently decrypts and securely analyzes the discovered model. As depicted in Figure 3, the proposed method is divided into three phases: (1) log encryption, (2) Alpha-PQC, and (3) model decryption. These phases are defined using the RLWE-based encryption scheme and the notation provided in Table A1.

Figure 3. General view of the proposed method.

• Log encryption: This phase is performed within the data owner’s environment. Each attribute in each event is separately encrypted using an RLWE-based non-deterministic fully homomorphic cryptosystem, resulting in the encrypted event log $\left[L\right]$. The log encryption phase ensures semantic security; that is, each encrypted data in the event log is distinct, thus preventing the identification of encrypted values that correspond to the same plaintext data.
• Alpha-PQC: This phase is carried out by the untrusted party in external and untrusted environments. Its objective is to discover a model from a fully non-deterministic encrypted event log without decrypting any data from the encrypted event log. This method leverages the homomorphic properties of an FHE scheme, particularly the operations of addition and multiplication.
• Model Decryption: This phase is executed after the process model has been discovered by the untrusted party. The encrypted process model, obtained from the previous phase, is sent to the data owner or intended end user. Using their private decryption keys, the data owner or end user decrypts the process model to access the results of the process discovery. This ensures that only authorized parties can access the cleartext process-discovered model while maintaining the security and privacy of the underlying data throughout the process.

4.2. Alpha-PQC Algorithms

Alpha-PQC, shown in Algorithm 1, performs process discovery over non-deterministically encrypted event logs using fully homomorphic operations. In Alpha-PQC, the discovery process does not require delegating operations to the data owner or end user until the unique ZCM is obtained. Even at this stage, no further disclosure of the log data occurs, as only the algorithm’s processing results are utilized. To illustrate the Alpha-PQC core logic execution, consider as an example the small event log $\left[L\right]=\{<[a],[b],[c]>,<[a],[d]>,<[a],[b]>\}$; total activities set: $\left[\mathcal{A}\right]=\left\{\right[a],[b],[c],[d\left]\right\}$.

Algorithm 1 Alpha-PQC

Require:  Encrypted event log $\left[L\right]$ and encrypted activity set $\left[\mathcal{A}\right]$ Ensure:  Petri net model M Executed by an untrusted party:   1: $\left[R\right]={\left[0\right]}^{\left|\mathcal{A}\right|\times \left|\mathcal{A}\right|}$   2: for all $\left[t_i\right]\in \left[L\right]$ do   3:     for all $\left[e_j^i\right]\in \left[t_i\right]$ such that $1\le j\le |t_i|$ do ▹ Fully Homomorphic Activity Extraction   4:         for all $\left[{\mathcal{A}}_k\right]\in \left[\mathcal{A}\right]$ such that $1\le k\le \left|\mathcal{A}\right|$ do   5:            $\left[A{D}_{k,j}^{t_i}\right]=\left[1\right]\ominus {\left(\left[e_j^i\right]\ominus \left[{\mathcal{A}}_k\right]\right)}^{t-1}$   6:         end for   7:     end for   8:     for $j\leftarrow 1$ to $|t_i|-1$ do       ▹ Fully Homomorphic Direct-Follow Detection   9:         $\left[A{D}^1\right]=\left[A{D}_{\ast ,j}^{t_i}\right]$ 10:         $\left[A{D}^2\right]=\left[A{D}_{\ast ,j+1}^{t_i}\right]$ 11:         for $k\leftarrow 1$ to $\left|\mathcal{A}\right|$ do 12:            for $m\leftarrow 1$ to $\left|\mathcal{A}\right|$ do 13:                $\left[\mathrm{mult}\right]=\left[A{D}_k^1\right]\otimes \left[A{D}_m^2\right]$ 14:                $\left[R_{k,m}\right]=\left[R_{k,m}\right]\oplus \left[\mathrm{mult}\right]$ 15:            end for 16:         end for 17:     end for 18: end for Executed by the data owner: 19: for all $\left[R_{m,n}\right]\in \left[R\right]$ do                ▹ Client-Assisted Zero Testing 20:     $v_{m,n}=\mathcal{D}(\left[R_{m,n}\right],k^{\mathcal{D}})$ 21:     ${\mathrm{ZCM}}_{m,n}=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}{v}_{m,n}\ne 0,\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$ 22: end for Executed by an untrusted party: 23: $M=\mathbf{DFG}\mathbf{2}\mathbf{PN}\left(\mathrm{ZCM}\right)$ 24: return M

4.2.1. Fully Homomorphic Activity Extraction

This stage is designed to securely identify which $\mathcal{A}$ activity corresponds to each event’s activity within a given trace. To achieve this, the service provider performs a direct fully homomorphic subtraction between each encrypted event $\left[e_i^j\right]$ and each encrypted activity label $\left[{\mathcal{A}}_m\right]\in \left[\mathcal{A}\right]$, using the operation $\left[A{D}_{m,n}^{t_i}\right]=1-{(\left[e_j^{t_i}\right]\ominus \left[{\mathcal{A}}_m\right])}^{t-1}$. This allows the untrusted party to determine equality in a fully homomorphic manner, without requiring an external secure equality protocol. If $\left[e_i^j\right]=\left[{\mathcal{A}}_m\right]$, then $\left[A{D}_{m,n}^{t_j}\right]$ is set to $\left[1\right]$ (encrypted “1”); otherwise, it is set to $\left[0\right]$ (encrypted “0”). As illustrated in Equation (1), this procedure is repeated for every $\left[e_i^j\right]$ in each $\left[t_j\right]$ of the encrypted event log $\left[L\right]$.

$$\begin{gathered} \left[{\mathrm{AD}}^{t_j}\right]=\left\{\begin{array}{cccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]\\ \left[\mathit{a}\right]& \left[1\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[1\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[1\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array},\begin{array}{ccc}& \left[\mathit{a}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[1\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[1\right]\end{array},\begin{array}{ccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]\\ \left[\mathit{a}\right]& \left[1\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[1\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]\end{array}\right\} \\ \left[{\mathrm{AD}}^{t_j}\right]=\left\{\left[{\mathrm{AD}}^{t_1}\right],\left[{\mathrm{AD}}^{t_2}\right],\left[{\mathrm{AD}}^{t_3}\right]\right\} \end{gathered}$$

(1)

4.2.2. Fully Homomorphic Direct-Follow Detection

To detect if two events $\left[e_i^j\right]$ and $\left[e_{i+1}^j\right]$ are subsequent, the columns i and $i+1$ in the matrix $\left[A{D}^{t_j}\right]$ are merged. As illustrated in Equations (2)–(4), each element in the current column $\left[A{D}_{\ast ,n}^{t_j}\right]$ is fully homomorphically multiplied (⊗) with the corresponding element in the transposed next column ${\left[A{D}_{\ast ,n+1}^{t_j}\right]}^T$. This avoids the need for an auxiliary secure multiplication protocol.

$$\begin{gathered} \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[1\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[1\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array}=\begin{array}{cc}& \left[\mathit{a}\right]\\ \left[\mathit{a}\right]& \left[1\right]\\ \left[\mathit{b}\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]\end{array}\otimes \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[1\right]& \left[0\right]& \left[0\right]\end{array}\oplus \begin{array}{cc}& \left[\mathit{b}\right]\\ \left[\mathit{a}\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[1\right]\\ \left[\mathit{c}\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]\end{array}\otimes \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[1\right]& \left[0\right]\end{array} \\ \left[R^{{\mathrm{AD}}^{t_1}}\right]=\left[{\mathrm{AD}}_{\ast ,1}^{t_1}\right]\otimes {\left[{\mathrm{AD}}_{\ast ,2}^{t_1}\right]}^T+\left[{\mathrm{AD}}_{\ast ,2}^{t_1}\right]\otimes {\left[{\mathrm{AD}}_{\ast ,3}^{t_1}\right]}^T \end{gathered}$$

(2)

$$\begin{gathered} \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[1\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array}=\begin{array}{cc}& \left[\mathit{a}\right]\\ \left[\mathit{a}\right]& \left[1\right]\\ \left[\mathit{b}\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]\end{array}\otimes \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[1\right]\end{array} \\ \left[R^{{\mathrm{AD}}^{t_2}}\right]=\left[{\mathrm{AD}}_{\ast ,1}^{t_2}\right]\otimes {\left[{\mathrm{AD}}_{\ast ,2}^{t_2}\right]}^T \end{gathered}$$

(3)

$$\begin{gathered} \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[1\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array}=\begin{array}{cc}& \left[\mathit{a}\right]\\ \left[\mathit{a}\right]& \left[1\right]\\ \left[\mathit{b}\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]\end{array}\otimes \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[1\right]& \left[0\right]& \left[0\right]\end{array} \\ \left[R^{{\mathrm{AD}}^{t_3}}\right]=\left[{\mathrm{AD}}_{\ast ,1}^{t_3}\right]\otimes {\left[{\mathrm{AD}}_{\ast ,2}^{t_3}\right]}^T \end{gathered}$$

(4)

The resulting values are then homomorphically added (⊕) to construct a new matrix $\left[R^{A{D}^{t_j}}\right]$, which denotes the encrypted activity sequences within a single trace. Subsequently, the overall matrix $\left[R\right]$ is obtained by summing all $\left[R^{A{D}^{t_j}}\right]$ matrices across the event log using homomorphic addition, as illustrated in Equation (5). This final matrix $\left[R\right]$ represents the activity succession frequencies observed throughout the entire encrypted event log.

$$\begin{gathered} \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[2\right]& \left[0\right]& \left[1\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[1\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array}=\begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[1\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[1\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array}\oplus \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[1\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array}\oplus \begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& \left[0\right]& \left[1\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{b}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{c}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\\ \left[\mathit{d}\right]& \left[0\right]& \left[0\right]& \left[0\right]& \left[0\right]\end{array} \\ \left[R\right]=\left[R^{{\mathrm{AD}}^{t_1}}\right]\oplus \left[R^{{\mathrm{AD}}^{t_2}}\right]\oplus \left[R^{{\mathrm{AD}}^{t_3}}\right] \end{gathered}$$

(5)

4.2.3. Client-Assisted Zero Testing

The untrusted party queries each index of the $\left[R\right]$ matrix from the data owner to obtain a “0” (unencrypted) if the decrypted data is “0”, or “1” otherwise. The data owner then returns a zero-check matrix (ZCM) to the untrusted party. An example of the ZCM is provided in Equation (6).

$$\begin{array}{ccccc}& \left[\mathit{a}\right]& \left[\mathit{b}\right]& \left[\mathit{c}\right]& \left[\mathit{d}\right]\\ \left[\mathit{a}\right]& 0& 1& 0& 1\\ \left[\mathit{b}\right]& 0& 0& 1& 0\\ \left[\mathit{c}\right]& 0& 0& 0& 0\\ \left[\mathit{d}\right]& 0& 0& 0& 0\end{array}$$

(6)

4.2.4. Directly-Follows Graph to Petri Net (DFG2PN)

This function in Algorithm 1 essentially transforms the ZCM into a PN. This transformation is possible because ZCM enables the construction of an encrypted DFG without the need for additional information. However, the transformation is necessary since the remaining steps of the original Alpha algorithm (5–8 steps) operate on a DFG structure.

Figure 4 illustrates the stages of the Alpha-PQC framework. Following the system model defined in Figure 1, the data owner encrypts the event log using the encryption key within a secure environment and shares the encrypted event log with the untrusted party. The untrusted party, operating in an untrusted environment, applies the Alpha-PQC algorithm to perform process discovery directly on the encrypted data without compromising its confidentiality. Once the encrypted process model is derived, it is securely transmitted back to the end user or data owner for decryption and utilization. This figure provides a clear overview of the three main phases of the framework: encryption, secure process discovery, and model decryption, emphasizing the preservation of data privacy (semantically safe) and data utility throughout the process.

Figure 4. General view of each stage in Alpha-PQC.

4.3. Security Analysis

In this section, we present a theoretical analysis of the security of our proposed method, considering both classical and post-quantum threat models. Our solution leverages FHE and PQC techniques to ensure the confidentiality of event logs and the discovered encrypted process models, even against adversaries equipped with quantum computing capabilities.

4.3.1. Threat Model

Alpha-PQC assumes an honest-but-curious service provider: it follows the prescribed protocol but may attempt to infer information from the encrypted event log, intermediate ciphertexts, protocol outputs, and observable metadata. The service provider (untrusted party) does not possess $k^{\mathcal{D}}$, which remains under the control of the data owner or an authorized end user.

The current construction does not guarantee correctness or integrity against a malicious service provider that deliberately deviates from the protocol. For example, a malicious provider could omit, reorder, or modify homomorphic operations, manipulate the encrypted relation matrix, or return an incorrect process model.

4.3.2. Confidentiality of Event Logs in Alpha-PQC

Alpha-PQC employs an FHE scheme to secure categorical (e.g., Activity) and numeric (e.g., Event ID) attributes. Since PHE-based approaches only support a limited set of homomorphic operations, secure computations often require auxiliary protocols or interaction with the data owner. This interactive nature increases the number of operations and overall computational overhead, potentially impacting efficiency.

However, the adoption of FHE enhances confidentiality by enabling direct computations on encrypted event logs without requiring intermediate decryption steps. The security of FHE is based on the hardness of lattice-based problems [40], such as RLWE, which remain intractable even in the presence of quantum adversaries. Thus, an attacker without access to the decryption key cannot:

• Infer relationships between specific events within the encrypted log.
• Reconstruct the sequence of activities in a given trace.
• Retrieve real timestamps of events.
• Identify participants involved in a particular activity.

The $\left[R\right]$ matrix hides the directly-follows frequencies from the untrusted party. Nevertheless, the ZCM reveals whether a directly-follows relation exists between each pair of encrypted activity identifiers. Therefore, the service provider learns the adjacency structure of the DFG, although it does not learn the plaintext semantic labels or the exact frequency of each relation from the ZCM alone. The remaining steps of the Alpha algorithm are executed by the service provider; the topology of the resulting PN is also observable over encrypted or pseudonymous activity identifiers.

This structural disclosure represents a limitation of the current construction. In addition to the adjacency information revealed by the ZCM, the service provider can observe metadata inherent to the representation of the outsourced L, including $\left|L\right|$, individual trace lengths, $\left|\mathcal{A}\right|$, and the dimensions of $\left[AD\right]$, $\left[R\right]$, and $ZCM$. Alpha-PQC protects the semantic content of events and activity labels rather than concealing the complete structural characteristics of L or the discovered $\mathcal{M}$.

By leveraging FHE, our method mitigates vulnerabilities associated with deterministic encryption schemes, which are susceptible to frequency analysis attacks. Unlike deterministic encryption, which lacks semantic security and allows data leakage, FHE ensures that identical plaintexts encrypt to different ciphertexts, preventing chosen-plaintext attacks and other cryptanalytic techniques. Moreover, only authorized users with the appropriate decryption key can access the resulting, decrypted process model.

4.3.3. Post-Quantum Security and Resistance to Advanced Attacks

Our method incorporates post-quantum cryptographic techniques, specifically lattice-based FHE [54], to ensure long-term security even in the advent of large-scale quantum computers. Classical cryptosystems, such as RSA and ECC, are vulnerable to Shor’s algorithm [53,55], which can efficiently factor large numbers and solve discrete logarithm problems, rendering them obsolete in a post-quantum era. In contrast, RLWE-based encryption schemes provide resistance against quantum attacks due to their reliance on high-dimensional lattice problems, which are currently considered quantum-secure. Additionally, our method prevents attack vectors, such as:

• Re-identification attacks: Since process mining relies on groups of events (cases), adversaries may attempt to link encrypted event data to known trace details, such as personal information, while the non-deterministic nature of FHE complicates such correlations.
• Attribute reconstruction attacks: By preventing direct access to individual encrypted attributes and applying FHE operations securely, attackers cannot reconstruct original data patterns.
• Membership disclosure attacks: The indistinguishability property of lattice-based cryptographic schemes ensures that attackers cannot determine whether a specific individual’s data is included in the encrypted event log.

By integrating post-quantum cryptographic techniques with FHE, our method not only secures outsourced process mining computations but also ensures long-term resilience against quantum attacks, making it a future-proof solution for PPPD.

4.4. Computational Analysis

Prior to analyzing Alpha-PQC, the computational cost of the original Alpha algorithm is considered. Let $|E_L|={\sum }_{t_i\in L}\left|t_i\right|$ denote the total number of events in the event log L, $\left|L\right|$ the number of traces, and $\left|\mathcal{A}\right|$ the number of distinct activities. In the plaintext approach, each event is identified with its corresponding activity and each pair of consecutive events is analyzed to determine the directly-follows relations. Thus, the dominant cost can be expressed as

$$\begin{array}{c}\hfill O\left(\left|\mathcal{A}\right|·|E_L|+(|E_L{|-|L\left|\right)·\left|\mathcal{A}\right|}^2\right).\end{array}$$

In Alpha-PQC, these operations are performed over encrypted data. The setup phase requires encrypting the events in L and the activity set $\mathcal{A}$, resulting in approximately $|E_L|+|\mathcal{A}|$ encryption operations $\mathcal{E}$.

During the Fully Homomorphic Activity Extraction phase, each encrypted event $\left[e_j^i\right]$ is compared with every encrypted activity $\left[{\mathcal{A}}_k\right]$. Consequently, the construction of the encrypted activity matrices $\left[A{D}^{t_i}\right]$ requires $\left|\mathcal{A}\right|·|E_L|$ homomorphic equality operations $H_{Eq}$.

The Fully Homomorphic Direct-Follow Detection phase analyzes every pair of consecutive events in each trace. The total number of consecutive event pairs is $|E_L|-|L|$. For each pair, the corresponding columns of $\left[A{D}^{t_i}\right]$ contain $\left|\mathcal{A}\right|$ elements and their pairwise combination requires ${\left|\mathcal{A}\right|}^2$ homomorphic multiplications. Each result is accumulated directly into the encrypted relation matrix $\left[R\right]$. Therefore, this phase requires $\left(\right|E_L{|-|L\left|\right)·\left|\mathcal{A}\right|}^2$ homomorphic multiplications $H_{Mult}$ and the same number of homomorphic additions $H_{Add}$.

Finally, the Client-Assisted Zero Testing phase requires the data owner to decrypt each element of the $\left|\mathcal{A}\right|\times \left|\mathcal{A}\right|$ matrix $\left[R\right]$ to construct the zero-check matrix ZCM. Hence, ${\left|\mathcal{A}\right|}^2$ decryption operations $\mathcal{D}$ are required. The resulting computational operations of Alpha-PQC are summarized in Table 3.

Table 3. Type and number of operations in Alpha-PQC.

Operation	Total
$\mathcal{E}$	$|E_L|+|\mathcal{A}|$
$H_{Eq}$	$\left|\mathcal{A}\right|·|E_L|$
$H_{Mult}$	$\left(\right|E_L{|-|L\left|\right)·\left|\mathcal{A}\right|}^2$
$H_{Add}$	$\left(\right|E_L{|-|L\left|\right)·\left|\mathcal{A}\right|}^2$
$\mathcal{D}$	${\left|\mathcal{A}\right|}^2$

5. Experimental Evaluation

A tool based on Alpha-PQC was developed and implemented as a proof of concept. This tool was used to perform the experimental evaluation of the Alpha-PQC method proposed in this work, demonstrating its ability to preserve privacy over event-log data while discovering a PN process model. The workflow involves encrypting the event log, outsourcing it to an untrusted party, executing the Alpha-PQC algorithm on the encrypted data within the honest-but-curious untrusted party, and enabling authorized end users to download, decrypt, and access the secured process models in their original form.

The overall architecture of the tool is divided into four primary modules—(1) key generator, (2) log encryption, (3) Alpha-PQC, and (4) model decryption—as illustrated in Figure 5. Each module corresponds to a specific stage in the data flow and operates within the environment of one of four actors: a trusted entity for key generation, the data owner, the untrusted party, or the end user.

Figure 5. Main modules of the evaluation tool based on Alpha-PQC.

• Key Generator: This module generates key pairs $\{k^{\mathcal{E}},k^{\mathcal{D}}\}$ for the data owner, based on a security parameter $\kappa$ defined for the RLWE-based cryptosystem. This cryptosystem ensures the semantic security of the event log L while enabling secure homomorphic operations required for process model discovery. In the current implementation, the keys are configured to provide a 128-bit security level. Key generation occurs offline in a trusted environment, and the resulting keys are stored as binary files.
• Log Encryption: This module encrypts L using the encryption key $k^{\mathcal{E}}$, producing the encrypted event log $\left[L\right]$, which can only be decrypted with the corresponding decryption key $k^{\mathcal{D}}$. L is input to this module in either CSV or XES format. During the experiment, only the Activity attribute is encrypted, while other attributes are discarded. Encryption is performed for each event in the log using an RLWE-based cryptosystem variant described in [41]. Consequently, the number of encryption operations is equal to ${\sum }_{j=0}^{\left|L\right|-1}\left|t_j\right|$. The encrypted event log $\left[L\right]$ is output in trace list format and sent to the untrusted party, along with the list of unique encrypted activities $\left[\mathcal{A}\right]$.
• Alpha-PQC: Upon receiving the encrypted event log, the untrusted party uses this module to compute a process model $\left[M\right]$. The FHE scheme allows the necessary computations for process model discovery to be performed on encrypted data, even without differentiating between ciphertext activities. The ZCM is calculated and transformed into a DFG structure represented as a list of edges with weights. This representation follows the format described in [56] for DFG models, enabling the realization of the final steps of the original alpha algorithm.
• Model Decryption: This module decrypts the encrypted process model $\left[M\right]$, providing the end user, who may also be the data owner, with a clear-text process model M. The module requires $\left[M\right]$ and the decryption key $k^{\mathcal{D}}$ as inputs to reconstruct the plaintext process model with its activity labels.

5.1. Data

The event logs used to evaluate the proposed method are summarized in Table 4. The evaluation includes five real-life event logs from healthcare, public administration, and business procurement domains, providing different numbers of events, traces, activities, and process behaviors. The Sepsis Cases event log [30] records the treatment of patients with symptoms of sepsis in a hospital and contains 16 distinct activities. The Healthcare Treatment event log [31] describes healthcare data-access and treatment-related activities, including patient admissions, medical visits, and test orders. The Hospital Billing event log [32] represents the execution of billing procedures for medical services and contains 18 distinct activities. To extend the evaluation beyond the healthcare domain, the Road Traffic Fines event log [33] was included, representing the management of road traffic fines by a public administration authority and comprising 561,470 events distributed across 150,370 traces. Finally, the BPIC 2019 event log [34] represents purchase-order handling within a multinational organization and constitutes the largest dataset in the evaluation, with 1,595,923 events, 251,734 traces, and 42 distinct activities.

Table 4. Real event-log data.

Event Log	Events	Activities	Traces	Size (MB)
Sepsis Cases [30]	15,214	16	1050	5.4
Healthcare Treatment [31]	176,798	13	10,000	48.8
Hospital Billing [32]	451,359	18	100,000	174.3
Road Traffic Fines [33]	561,470	11	150,370	185.4
BPIC 2019 [34]	1,595,923	42	251,734	728.6

5.2. Security Level

The experimental evaluation considers a security level denoted by the security parameter $\kappa$. For the RLWE-based setting over the ring $R_q={\mathbb{Z}}_q\left[x\right]/\left(f\left(x\right)\right)$, a polynomial degree $n=2^{10}$ is commonly associated with lower security margins, whereas higher dimensions such as $n=2^{14}$ are typically required for stronger post-quantum security settings [57]. Specifically, AlphaSec is instantiated with a 3072-bit Paillier key, while Alpha-PQC uses the BFV implementation provided by OpenFHE [58] with the RLWE parameters summarized in Table 5.

Table 5. BFV parameters used by Alpha-PQC.

Parameter	Value
$\kappa$	128-bit
$f\left(x\right)$	$x^n+1$
n	$2^{14}=$ 16,384
Ciphertext modulus	$logq\approx 450$ bits
Plaintext modulus t	65,537 = $2^{16}+1$
$\chi$	Discrete Gaussian, $\sigma =3.2$
Secret dist.	Uniform ternary $\{-1,0,1\}$

For Alpha-PQC, the polynomial modulus is defined as $f\left(x\right)=x^n+1$, with $n=2^{14}$ = 16,384. The ciphertext modulus has an aggregate bit-length of approximately $logq\approx 450$ bits. The plaintext space is defined over $R_t={\mathbb{Z}}_t\left[x\right]/\left(f\left(x\right)\right)$, using the prime plaintext modulus $t=$ 65,537 $=2^{16}+1$. Since $t\equiv 1(mod2n)$, this modulus supports packed encoding based on the number-theoretic transform. The error distribution $\chi$ is sampled from a discrete Gaussian distribution with standard deviation $\sigma =3.2$, while the secret key is sampled from a uniform ternary distribution over $\{-1,0,1\}$.

The multiplicative depth was determined from the most demanding circuit evaluated by Alpha-PQC. During the homomorphic equality test, the ciphertext difference $\left[d\right]=[m-m^{\prime }]$ is raised to $t-1=$ 65,536 $=2^{16}$. Using repeated squaring, this exponentiation requires a multiplicative depth of 16. The subsequent Fully Homomorphic Direct-Follow Detection stage multiplies two encrypted equality indicators, introducing one additional multiplication level. Therefore, the maximum multiplicative depth required by Alpha-PQC is configured as ${log}_2(t-1)+1=16+1=17$.

Increasing the parameter size, such as the ring dimension n, ciphertext modulus q, or multiplicative depth, increases the computational cost because arithmetic is performed over larger polynomial rings and RNS modulus chains. In BFV, these parameters must also accommodate the noise growth produced mainly by ciphertext multiplications. The selected configuration provides sufficient depth for the Alpha-PQC circuit without bootstrapping while targeting the security level considered in this work. These parameters are consistent with the RLWE-based security estimates adopted for the experimental evaluation [59].

5.3. Utility Loss

The utility loss was assessed using the real data event logs presented in Table 4 by comparing the models derived from their clear-text versions (M) with those obtained from their encrypted counterparts ($\left[M\right]$), processed through the AlphaSec and Alpha-PQC algorithms. The evaluation involved analyzing the conformance of each discovered model by measuring its fitness, precision, simplicity, and density, in accordance with the definitions provided in [60]. These metrics were employed to compare the decrypted models with the model generated by the unprotected Alpha algorithm in order to identify any potential utility loss.

Figure 6 illustrates the decrypted process model obtained using the Alpha-PQC algorithm for the Sepsis Cases event log. Table 6 summarizes the structural characteristics of the decrypted process models generated from the event logs described in Table 4. In addition, the conformance metrics of the models discovered from these event logs are presented in Figure 7. The results show that models discovered from the same event log remain consistent across different discovery algorithms, indicating that Alpha-PQC introduces no utility loss compared with models discovered directly from the clear-text event logs.

Figure 6. Decrypted PN model discovered with the Alpha-PQC algorithm from the encrypted Sepsis Cases event log.

Table 6. Features of the discovered PN models.

Event Log	Algorithm	Arcs	Places	Transitions
Sepsis Cases [30]	Alpha	451	70	18
	AlphaSec	451	70	18
	Alpha-PQC	451	70	18
Healthcare Treatment [31]	Alpha	119	42	20
	AlphaSec	119	42	20
	Alpha-PQC	119	42	20
Hospital Billing [32]	Alpha	356	53	20
	AlphaSec	356	53	20
	Alpha-PQC	356	53	20
Road Traffic Fines [33]	Alpha	231	34	13
	AlphaSec	231	34	13
	Alpha-PQC	231	34	13
BPIC 2019 [34]	Alpha	837	125	47
	AlphaSec	837	125	47
	Alpha-PQC	837	125	47

Figure 7. Results of the conformance metrics for event logs: (a) Sepsis Cases, (b) Healthcare Treatment, (c) Hospital Billing, (d) Road Traffic Fines, and (e) BPIC 2019.

5.4. Performance

This subsection evaluates Alpha-PQC against two baselines: the original Alpha algorithm without encryption and AlphaSec as a representative PHE-based PPPD method. The evaluation was conducted on a computing platform running macOS with an M1 Pro processor and 16 GB of RAM. Each performance experiment was repeated 31 times, and the mean was reported, following the central limit theorem to reduce the variability. The Alpha algorithm was implemented in Java in the original version. AlphaSec was also implemented in Java, using an implementation of the Paillier cryptosystem. The Alpha-PQC algorithm was implemented in Java, using the BFV scheme from [58], which is implemented in C++.

Although the privacy protocols used by the AlphaSec algorithm for model discovery introduce additional overhead, to ensure consistency, all three environments (data owner, untrusted party, and end user) were deployed on the same machine for all three algorithms, and data transfer times were excluded from the evaluation.

The original Alpha algorithm does not incorporate encryption or any security mechanisms, meaning that the event log remains unchanged throughout the discovery. In contrast, AlphaSec and Alpha-PQC encrypt each event activity individually, even when repeated, ensuring semantic security by producing unique ciphertexts for identical plaintext values.

The computational cost is summarized in Table 7. For Alpha-PQC, the reported values correspond to the cryptographic and homomorphic operations defined in Table 3. As described in the computational analysis, the dominant cost is associated with the direct-follow detection stage, which requires $\left(\right|E_L{|-|L\left|\right)·\left|\mathcal{A}\right|}^2$ homomorphic additions and the same number of homomorphic multiplications. Therefore, the computational cost increases with the number of consecutive event pairs and quadratically with the number of distinct activities.

Table 7. Computational performance.

	Alpha	Alpha-PQC
Event Log	# Operations	#$\mathcal{E}$	#${\mathit{H}}_{\mathit{Add}}$	#${\mathit{H}}_{\mathit{Mult}}$	#${\mathit{H}}_{\mathit{Eq}}$	#$\mathcal{D}$	∑
Sepsis Cases [30]	3,869,408	15,230	3,625,984	3,625,984	243,424	256	7,510,878
Healthcare Treatment [31]	30,487,236	176,811	28,188,862	28,188,862	2,298,374	169	58,853,078
Hospital Billing [32]	121,964,778	451,377	113,840,316	113,840,316	8,124,462	324	236,256,795
Road Traffic Fines [33]	55,919,270	561,481	49,743,100	49,743,100	6,176,170	121	106,223,972
BPIC 2019 [34]	2,438,178,162	1,595,965	2,371,149,396	2,371,149,396	67,028,766	1764	4,810,925,287

#: Number of operations.

Table 7 shows that larger and more behaviorally diverse event logs require substantially more cryptographic operations. In particular, BPIC 2019 presents the highest computational cost due to the combination of its large number of events and its 42 distinct activities, which significantly increases the number of pairwise homomorphic operations required during directly-follows detection.

Figure 8 illustrates the time performance of each algorithm in discovering process models using real event logs. The encryption-based approaches exhibited a significant impact on computation time, with an increase as the number of events grew. In general, the larger the number of events in an event log, the more challenging the discovery process becomes [36]. This depends on factors such as the length and behavior of the workflow, as well as the number of distinct activities. However, the privacy overhead introduced by AlphaSec and Alpha-PQC increases the discovery time due to the additional cost of encryption, homomorphic operations, and decryption required during execution.

Figure 8. Response time of each strategy for the discovery of process models.

5.5. Limitations

Although the experimental results demonstrate the feasibility of Alpha-PQC, some limitations of the current study should be considered:

• Alpha-PQC protects the semantic content of the event log but it does not completely hide structural information from the untrusted party. Since the encrypted event log preserves its trace-based representation, the service provider can observe metadata such as the number of traces, the length of each trace, the number of distinct encrypted activities, and the dimensions of the intermediate data structures. Furthermore, the ZCM reveals the existence of directly-follows relations between protected activity identifiers, and the subsequent process discovery steps expose the topology of the resulting process model. However, the plaintext activity labels and the exact frequencies contained in the encrypted relation matrix $\left[R\right]$ remain protected. Therefore, Alpha-PQC provides confidentiality of the event-log content, but it does not aim to provide complete structural or metadata obliviousness.
• The performance analysis excludes communication costs. All actors were deployed on the same computing platform to provide a controlled environment and isolate the computational overhead of the cryptographic and process discovery operations from external network conditions. Therefore, network latency, transmission, and bandwidth requirements were not measured.

6. Conclusions

This work introduced Alpha-PQC, a novel FHE-based method for PPPD within the honest-but-curious model. The proposed method enables semantically secure outsourcing of event-log data to an untrusted party while preserving the ability to discover process models without exposing sensitive information. Alpha-PQC addresses the limitations of PHE approaches by enabling encrypted process discovery through RLWE-based fully homomorphic operations.

The use of an RLWE-based cryptosystem enables fully homomorphic computations. Consequently, the proposed design reduces the need for auxiliary secure protocols and allows most computations to be performed within the untrusted party. In addition, it enhances the security level by providing quantum-resistant protection.

To evaluate the effectiveness of Alpha-PQC, we developed a proof-of-concept implementation and compared its performance against two alternative strategies: Alpha (unencrypted process discovery) and AlphaSec (Paillier-based encryption). Experimental results on real-world data event logs demonstrated that Alpha-PQC successfully discovers process models while ensuring data confidentiality. Furthermore, the results confirmed that utility loss remains negligible, as decrypted models retain the same structural properties as those obtained from clear-text logs. In addition, Alpha-PQC exhibited a significant efficiency improvement over AlphaSec. On average across the evaluated settings, Alpha-PQC achieved an approximate $2.07$ speedup over AlphaSec, corresponding to an average execution time reduction of approximately $46.8\%$.

Future work will focus on adapting other process discovery algorithms to operate with non-deterministic and fully homomorphic encrypted event logs, leveraging homomorphic computations, semantic security, and quantum-resistant encryption. In addition, Alpha-PQC will be evaluated in a cloud-based distributed environment where each actor is independently deployed to assess communication overhead and complete end-to-end execution time. Overall, this research advances secure PPPD, laying the foundation for its adoption in highly regulated domains such as healthcare, finance, and government applications.