Privacy-Preserving Conformance Checking Using Quantum-Safe Fully Homomorphic Encryption

Abstract

Conformance checking is a fundamental task in process mining that evaluates how well the observed executions recorded in event logs conform to a given process model. This task enables the identification of deviations, inefficiencies, and bottlenecks in real-world business processes, thereby supporting process improvement and compliance analysis. However, when business processes are deployed in untrusted environments, outsourcing both event logs and process models introduces significant privacy risks, as sensitive operational information may be exposed to external service providers. Existing privacy-preserving conformance checking (PPCC) approaches remain limited, as they primarily rely on partial anonymization, secure multiparty computation, or lightweight encryption mechanisms, without enabling computation directly over encrypted data. This paper introduces a novel PPCC method based on post-quantum fully homomorphic encryption (FHE). The proposed method performs token-based replay fitness evaluation directly over encrypted process models and encrypted event logs. Specifically, the method incorporates a privacy-preserving token-based replay mechanism that homomorphically evaluates encrypted Petri net models and encrypted event logs, enabling the fitness value to be obtained while preserving data confidentiality throughout the computation process. To the best of our knowledge, this is the first method that enables token-based replay fitness computation entirely in the encrypted domain using post-quantum FHE. An experimental evaluation was conducted using synthetic and real-life event logs to analyze the proposed method in terms of utility preservation, computational performance and scalability. The results demonstrate that the encrypted-domain fitness computation produces results equivalent to those obtained in the plaintext setting, while introducing manageable computational overhead. By combining formal conformance checking techniques with quantum-resistant cryptography, the proposed method enables privacy-preserving fitness analysis under outsourced and untrusted environments.