Semi-formal transformation of secure business processes into analysis class and use case models: An MDA approach

ContextModel-Driven Development (MDD) is an alternative approach for information systems development. The basic underlying concept of this approach is the definition of abstract models that can be transformed to obtain models near implementation. One fairly widespread proposal in this sphere is that of Model Driven Architecture (MDA). Business process models are abstract models which additionally contain key information about the tasks that are being carried out to achieve the company’s goals, and two notations currently exist for modelling business processes: the Unified Modelling Language (UML), through activity diagrams, and the Business Process Modelling Notation (BPMN).ObjectiveOur research is particularly focused on security requirements, in such a way that security is modelled along with the other aspects that are included in a business process. To this end, in earlier works we have defined a metamodel called secure business process (SBP), which may assist in the process of developing software as a source of highly valuable requirements (including very abstract security requirements), which are transformed into models with a lower abstraction level, such as analysis class diagrams and use case diagrams through the approach presented in this paper.MethodWe have defined all the transformation rules necessary to obtain analysis class diagrams and use case diagrams from SBP, and refined them through the characteristic iterative process of the action-research method.ResultsWe have obtained a set of rules and a checklist that make it possible to automatically obtain a set of UML analysis classes and use cases, starting from SBP models. Our approach has additionally been applied in a real environment in the area of the payment of electrical energy consumption.ConclusionsThe application of our proposal shows that our semi-automatic process can be used to obtain a set of useful artifacts for software development processes.     

UML在业务过程再工程中的应用研究

企业的分布性，电子商务的出现为企业的发展带来新的机遇和挑战， 的环境和需求往往不可避免地需要对已有的系统进行逆向工程（reverse engineering)，对业务过程的逆向工程称为业务过程再工程（Business Process Reengineering,BPR)，它是为了取得突破性改变而对业务过程进行根本性改变的研究与实现过程。本文介绍了BPR的概念，主要原则和一般模型，也介绍了UML的十种图和扩展机制，提出并讨论了用UML支持BPR六个阶段的方法。     

Semantic constraint specification and verification of ebXML business process specifications

Electronic Business using eXtensible Markup Language (ebXML) Business Process Specification Schema (BPSS) supports the specification of the set of elements required to configure a runtime system in order to execute a set of ebXML business transactions. The BPSS is available in two stand-alone representations; a UML version and an XML version. Due to the limitations of UML notations and XML syntax, however, the current ebXML BPSS specification is insufficient to formally specify semantic constraints of modeling elements. In this study, we propose a classification scheme for BPSS semantic constraints, and describe how to represent those semantic constraints formally using Object Constraint Language. As a way to verify a particular Business Process Specification (BPS) with formal semantic constraint modeling, we suggest a rule-based approach to represent the formal semantic constraints, and describe a detail mechanism to apply the rule-based specified constraints to the BPS in a prototype implementation.     

Embedding requirements within Model-Driven Architecture

Model-Driven Architecture (MDA) brings benefits to software development, among them the potential for connecting software models with the business domain. This paper focuses on the upstream or Computation-Independent Model (CIM) phase of MDA. Our contention is that, whilst there are many models and notations available within the CIM phase, those that are currently popular and supported by the Object Management Group (OMG) may not be the most useful notations for business analysts nor sufficient to fully support software requirements and specification. Therefore, with specific emphasis on the value of the Business Process Modelling Notation (BPMN) for business analysts, this paper provides an example of a typical CIM approach before describing an approach that incorporates specific requirements techniques. A framework extension to MDA is then introduced, which embeds requirements and specification within the CIM, thus further enhancing the utility of MDA by providing a more complete method for business analysis.     

Increasing the efficiency of business processes using a theory of constraints

In this study, a Theory of Constraints (TOC)-based method was developed to enhance the efficiency of business processes. Whereas the TOC has been employed in manufacturing processes, the present paper shows that it can be effective also for Business Process Management (BPM). In order to apply the TOC to business processes, a Drum-Buffer-Rope (DBR) scheduling method for a Business Process Management System (BPMS) was developed. A procedure by which business process efficiency can be improved using these concepts is presented. To validate our approach, a series of simulations of a real banking process was conducted, on the basis of which the applicability of the proposed method was analyzed. Based on the analysis results, we show that the TOC-based method can improve business process efficiency, particularly under heavy workloads with limited resources. And we suggest, accordingly, several guidelines that can be followed for the efficient management of business processes.     

A New Approach Towards Procurement of Software Models Via Distributed Business Models

Nowadays the distributive nature of many modern enterprises leads business strategists to look forward to new solutions which could take over this new requirement. The ever-increasing surge of e-business trend is another driving force for dealing with new distributed environment in addition to the serious need for core software components. On the other hand, the major role of these information systems in survival of business while tight competition exists is a facet which reveals another requirement focused on the robust relationship of business and the system(s) maintaining it. In this paper we aim to introduce a new approach to procure software models by means of the underlying business model. Since the introduction of UML as the latest OMG standard modeling language in 1997, a few researches have been done to use UML as a tool for business modeling. Unfortunately, recent trends are still immature and confronted with shortages and deficiencies. BSUP, which stands for Business to Software Unified Process, is our new approach to fulfill such a goal by means of a proprietary extension of UML. In this work, while analyzing the issues causing problems in the existing methods, we show how BSUP successfully resolves a few of such problems. Issues such as distributed processes, uncertainty in values and associations, ambiguity in the model, lack of precisely defined semantics and etc. may successfully be addressed and resolved. The BSUP is an ongoing work currently being evaluated in Paxan Corp,¹ a mid-scale industrial environment and a leading manufacturer of cosmetics and detergent products in the region. So far a few encouraging benefits have been revealed as briefly discussed within this paper.     

Securing business processes using security risk-oriented patterns

Business process modelling and security engineering are two important concerns when developing information system. However current practices report that security is addressed at the later development stages (i.e. design and implementation). This raises a question whether the business processes are performed securely. In this paper, we propose a method to introduce security requirements to the business processes through the collaboration between business and security analysts. To support this collaboration we present a set of security risk-oriented patterns. We test our proposal in two industrial business models. The case findings characterise pattern performance when identifying business assets, risks, and countermeasures.     

Business process management with the user requirements notation

A number of recent initiatives in both academia and industry have sought to achieve improvements in e-businesses through the utilization of Business Process Management (BPM) methodologies and tools. However there are still some inadequacies that need to be addressed when it comes to achieving alignment between business goals and business processes. The User Requirements Notation (URN), recently standardized by ITU-T, has some unique features and capabilities beyond what is available in other notations that can help address alignment issues. In this paper, a URN-based framework and its supporting toolset are introduced which provide business process monitoring and performance management capabilities integrated across the BPM lifecycle. The framework extends the URN notation with Key Performance Indicators (KPIs) and other concepts to measure and align processes and goals. An example process for controlling access to a healthcare data warehouse is used to illustrate and evaluate the framework. Early results indicate the feasibility of the approach.     

Automatic derivation of BPEL4WS from IDEF0 process models

Integration definition for function modelling (IDEF0) is one of the most popular notations for modelling business processes. It employs a rather simple and intuitive modelling construct, consisting of boxes representing functions and arrows connecting them signifying flow of information and materials. Web services on the other hand are an emerging technology for implementing distributed systems. Web service orchestration languages, such as Business Process Execution Language for Web Services (BPEL4WS), are the emerging approach for describing processes as networks of coordinated web services. Business processes as captured in IDEF0 models, however, may contain both web services as well as other types of activities which need to be coordinated. By automatically analysing the Extensible Markup Language (XML) definition of an IDEF0 model, we can identify how web services interact with other activities and at runtime generate code to support the orchestration of web services with the overall business process. The approach proposed is independent of the orchestration language and ensures an implementation independent model for specifying web service orchestrations. This approach also enables the top-down analysis of a business process to its constituent web services and avoids any misalignment problems during design time between the two.     

Integrating constraints to support legally flexible business processes

Flexible collaboration is a notable attribute of Web 2.0, which is often in the form of multiple users participating different activities that together complete a whole business process. In such an environment, business processes may be dynamically customized or adjusted, as well as the participants may be selected or attend uncertainly. So how to ensure the legitimacy of a business process for both security and business is increasingly critical. In this paper, we investigate this problem and introduce a novel method to support legally flexible business processes. The proposed Constraint-based Business Process Management Model incorporates constraints into the standard activities composing a business process, where the security constraints place restrictions on participants performing the activities and business constraints restrict the dependencies between multiple activities. By the assembly operations, business processes can be dynamically generated and adjusted with activities, that are obliged to the specified constraints. Several algorithms are presented to verify the consistency of constraints and the soundness of the generated business processes, as well as to perform the execution planning to guarantee the correct execution of a business process on the precondition of satisfying all constraints. We present an illustrative example and implement a prototype for the proposed model that is an application of property rights exchange for supporting legal business processes.     

基于UML的需求分析过程研究

为提高软件生产过程的质量,文章提出了一种基于UML的概念建模方法。概念建模的目的是用一种规约详细描述系统的功能，主要工作是寻找系统必需的类。该方法利用熟知的UML的标准符号和技术．介绍了以时序图作为分析工具，将高层次的软件需求分解成更详细规约的需求分析过程(RAP),并讨论了确认、验证和可跟踪性问题。     

XrML-RBLicensing approach adapted to the BPEL process of composite web services

Web service orchestration represents an open and standards-based approach for connecting web services together leading to higher level of business processes. Business Process Execution Language (BPEL) engines are designed to handle this orchestration. However, web service compositions into BPEL suffer from several non-functional requirements such as security. To address this problem, we propose in this paper a novel approach that is based on a harmony between the licensing concept offered by eXtensible rights Markup Language (XrML), aspect-oriented programming (AOP), and web service compositions in BPEL. Our proposed approach, based on XrML, offers the ability to associate security licenses with activities offered by the composite web services. It allows to automatically generate BPEL aspects depending on the developed licenses, to separate between crosscutting concerns of the composed web services, and provides an easy way to include and update the non-functional requirements (e.g., security) into a BPEL process. It offers also the ability to validate the licenses, at runtime and without affecting the business logic of this model. To evaluate our approach, we have developed an inventory control system (ICS) sample that is composed of several web services. Case study and performance analysis are presented to demonstrate its feasibility as well.     

基于ASM扩展的活动图进行业务过程建模

为了扩展包括投资者建模、企业建模与扩展价值链建模的Martin／Odell OOA／D方法,该文章使用UML活动图扩展这些技术。UML提供了丰富的标记表示对分析系统行为和系统结构进行分析。其中活动图是用来描述系统的动态行为,并且也适用于业务过程建模。但由于UML的语义是用纯文本的方式描述的,通常不够准确,故而此文提出了使用ASM扩展语义的活动图描述包含上述建模技术的业务过程。     

Event-based failure prediction in distributed business processes

Traditionally, research in Business Process Management has put a strong focus on centralized and intra-organizational processes. However, today’s business processes are increasingly distributed, deviating from a centralized layout, and therefore calling for novel methodologies of detecting and responding to unforeseen events, such as errors occurring during process runtime. In this article, we demonstrate how to employ event-based failure prediction in business processes. This approach allows to make use of the best of both traditional Business Process Management Systems and event-based systems. Our approach employs machine learning techniques and considers various types of events. We evaluate our solution using two business process data sets, including one from a real-world event log, and show that we are able to detect errors and predict failures with high accuracy.     

Security-aware Business Process as a Service by hiding provenance

We adress in this paper the security issues that arise when outsourcing business processes in the BPaaS (Business Process as a Service). In particular when sharing and reusing process fragments coming from different organizations for faster and easier development of process-based applications (PBA). The goal is twofold, to preserve the process fragment provenance, i.e., the companies's business activities which provide the reused fragments in order to avoid the competition, and to guarantee the end-to-end availability of PBA to fragment's consumers. We formally define the problem, and offer an efficient anonymization-based protocol. Experiments have been conducted to show the effectiveness of the proposed solution.     

A metamodel to integrate business processes time perspective in BPMN 2.0

ContextBusiness Process Management (BPM) is becoming a strategic advantage for organizations to streamline their operations. Most business experts are betting for OMG Business Process Model and Notation (BPMN) as de-facto standard (ISO/IEC 19510:2013) and selected technology to model processes. The temporal dimension underlies in any kind of process however, technicians need to shape this perspective that must also coexist with task control flow aspects, as well as resource and case perspectives. BPMN poorly gathers temporary rules. This is why there are contributions that extend the standard to cover such dimension. BPMN is mainly an imperative language. There are research contributions showing time constraints in BPMN, such as (i) BPMN patterns to express each rule with a combination of artifacts, thus these approaches increase the use of imperative BPMN style, and (ii) new decorators to capture time rules semantics giving clearer and simpler comprehensible specifications. Nevertheless, these extensions cannot yet be found in the present standard.ObjectiveTo define a time rule taxonomy easily found in most business processes and look for an approach that applies each rule with current BPMN 2.0 standard in a declarative way.MethodA model-driven approach is used to propose a BPMN metamodel extension to address time-perspective.ResultsWe look at a declarative approach where new time specifications may overlie the main control flow of a BPMN process. This proposal is totally supported with current BPMN standard, giving a BPMN metamodel extension with OCL constraints. We also use AQUA-WS as a software project case study which is planned and managed with MS Project. We illustrate business process extraction from project plans.ConclusionThis paper suggests to handle business temporal rules with current BPMN standard, along with other business perspectives like resources and cases. This approach can be applied to reverse engineering processes from legacy databases.     

Modeling functional requirements for configurable content- and context-aware dynamic service selection in business process models

In this article, we propose a meta-model for formal specification of functional requirements for configurable content- and context-aware dynamic service selection in business process models with the objective to enable greater flexibility of the modeled processes. The dynamic service selection can cope with highly dynamic business environments that today's business processes must handle. Modeling functional requirements for dynamic service selection in business process models is not well covered in literature. Some partial solutions exist but none of them allows modeling a complete set of functional requirements for the selection similar to the one we are addressing in this article. Our meta-model enables formal specification of service selection relevant data extracted from service request message, custom configuration data (e.g., thresholds), process and task definition/instance metadata, and service selection rules. The meta-model is configurable and content- and context-aware. Processes leveraging our meta-model can adapt to changing requirements without redesign of the process flow. Proposed meta-model allows users to additionally configure the models at run time (e.g., raising a threshold). Modeling can be divided into roles with different required competences. We implement our meta-model in BPMN 2.0 (Business Process Model and Notation) through specific extensions to the BPMN semantic and diagram elements. By measuring complexity of real-world sample process models we show that using our solution modelers can efficiently model business processes that need to address frequent changing demands. Compared to available alternatives, models using our solution have on average ～13% fewer activities, ～16% fewer control-flow elements and ～22% fewer control paths. By reading ～10% smaller models (by volume) model readers get more flexible process models that capture all functional requirements for the dynamic selection.     

Incorporating technology in service-oriented i* business models: a case study

In recent years, considerable attention has been paid to enterprise information systems. This interest is motivated by the need for achieving better integration of new technologies (hardware and software) with the business processes of an organization. Business processes have become more and more dependent on technologies because technology has a direct impact on business processes, changing the way they are performed and thus also affecting the way analysts design the software system. However, at the present time, there are still some gaps between the definition of business processes and the technologies used in the organization. In practice, organizations have carried out their business processes using different technologies; however, it is sometimes not possible to determine how technologies are useful in achieving current business goals. This is because business models do not explicitly consider the technologies in the organizational requirements. The goal of this paper is to present a systematic process for integrating business processes and technologies at the conceptual level. To validate our approach, we present a case study that describes the processes of the inventory management department of a public research center.