Secure Process-driven SystemsModern enterprise systems need to implement and comply to increasingly complex security, compliance, and privacy policies. To address this need, we developed SecureBPMN, a model-driven security approach for process-driven systems.
SecureBPMN: model-driven security for process-driven systems §
SecureBPMN is a model-driven security approach for business-process-driven systems. SecureBPMN integrates security and privacy aspects into BPMN. It allows modeling, formally analyze SecureBPMN models as well as to generate code and configuration artifacts.
On the one hand, SecureBPMN provides a domain-specific modeling language that allows to model security aspects (e.g., access control, separation of duty, confidentiality). SecurePBPMN is defined as a metamodel that can easily be integrated into BPMN and, thus, can be used for modeling secure and business processes as well as secure service compositions.
On the other hand, SecureBPMN provides and end-to-end modeling, verification, and validation approach for building systems that comply to complex security, privacy, or compliance requirements. The SecureBPMN tool chain does not only support modeling of secure business process and service compositions: it also supports the formal analysis both on the level of SecureBPMN models and refinement properties between the model and the actual implementation.
The SecureBPMN tool chain is free software: its source code is available in our git repository.
Important Publications §
[1]
M. Kohler, A. D. Brucker, and A. Schaad, “ProActive Caching: Generating caching heuristics for business process environments,” in International conference on computational science and engineering (CSE), vol. 3, Los Alamitos, CA, USA: IEEE Computer Society, 2009, pp. 207–304. doi: 10.1109/CSE.2009.177. Author copy: http://logicalhacking.com/publications/kohler.ea-proactive-2009/
[2]
M. Kohler and A. D. Brucker, “Caching strategies: An empirical evaluation,” in International workshop on security measurements and metrics (MetriSec), New York, NY, USA: ACM Press, 2010, pp. 1–8. doi: 10.1145/1853919.1853930. Author copy: http://logicalhacking.com/publications/kohler.ea-caching-2010/
[3]
G. Monakova, A. D. Brucker, and A. Schaad, “Security and safety of assets in business processes,” in ACM symposium on applied computing (SAC), 2012, pp. 1667–1673. doi: 10.1145/2245276.2232045. Author copy: http://logicalhacking.com/publications/monakova.ea-securing-2012/
[4]
A. D. Brucker, I. Hang, G. Lückemeyer, and R. Ruparel, “SecureBPMN: Modeling and enforcing access control requirements in business processes,” in ACM symposium on access control models and technologies (SACMAT), 2012, pp. 123–126. doi: 10.1145/2295136.2295160. Author copy: http://logicalhacking.com/publications/brucker.ea-securebpmn-2012/
[5]
G. Monakova, C. Severin, A. D. Brucker, U. Flegel, and A. Schaad, “Monitoring security and safety of assets in supply chains,” in Future security, 2012, vol. 318, pp. 9–20. doi: 10.1007/978-3-642-33161-9_3. Author copy: http://logicalhacking.com/publications/monakova.ea-monitoring-2012/
[6]
A. D. Brucker and I. Hang, “Secure and compliant implementation of business process-driven systems,” in Joint workshop on security in business processes (SBP), 2012, vol. 132, pp. 662–674. doi: 10.1007/978-3-642-36285-9_66. Author copy: http://logicalhacking.com/publications/brucker.ea-secure-2012/
[7]
L. Compagna, P. Guilleminot, and A. D. Brucker, “Business process compliance via security validation as a service,” in IEEE sixth international conference on software testing, verification and validation (ICST), 2013, pp. 455–462. doi: 10.1109/ICST.2013.63. Author copy: http://logicalhacking.com/publications/compagna.ea-bp-compliance-2013/
[8]
A. D. Brucker, F. Malmignati, M. Merabti, Q. Shi, and B. Zhou, “A framework for secure service composition,” in International conference on information privacy, security, risk and trust (PASSAT), Los Alamitos, CA, USA: IEEE Computer Society, 2013, pp. 647–652. doi: 10.1109/SocialCom.2013.97. Author copy: http://logicalhacking.com/publications/brucker.ea-framework-2013/
[9]
A. D. Brucker, “Integrating security aspects into business process models,” it - Information Technology, vol. 55, no. 6, pp. 239–246, Dec. 2013, doi: 10.1524/itit.2013.2004. Special Issue on “Security in Business Processes.” Author copy: http://logicalhacking.com/publications/brucker-securebpmn-2013/
[10]
A. D. Brucker, “Using SecureBPMN for modelling security-aware service compositions,” in Secure and trustworthy service composition: The aniketos approach, A. D. Brucker, F. Dalpiaz, P. Giorgini, P. H. Meland, and E. Rios, Eds. Heidelberg: Springer-Verlag, 2014, pp. 110–120. doi: 10.1007/978-3-319-13518-2_8. Author copy: http://logicalhacking.com/publications/brucker-aniketos-securebpmn-2014/
[11]
A. D. Brucker, F. Malmignati, M. Merabti, Q. Shi, and B. Zhou, “Aniketos service composition framework: Analysing and ranking of secure services,” in Secure and trustworthy service composition: The aniketos approach, A. D. Brucker, F. Dalpiaz, P. Giorgini, P. H. Meland, and E. Rios, Eds. Heidelberg: Springer-Verlag, 2014, pp. 121–135. doi: 10.1007/978-3-319-13518-2_9. Author copy: http://logicalhacking.com/publications/brucker.ea-aniketos-scf-2014/
[12]
A. D. Brucker, L. Compagna, and P. Guilleminot, “Compliance validation of secure service compositions,” in Secure and trustworthy service composition: The aniketos approach, A. D. Brucker, F. Dalpiaz, P. Giorgini, P. H. Meland, and E. Rios, Eds. Heidelberg: Springer-Verlag, 2014, pp. 136–149. doi: 10.1007/978-3-319-13518-2_10. Author copy: http://logicalhacking.com/publications/brucker.ea-aniketos-compliance-2014/
[13]
M. Asim, A. Yautsiukhin, A. D. Brucker, B. Lempereur, and Q. Shi, “Security policy monitoring of composite services,” in Secure and trustworthy service composition: The aniketos approach, A. D. Brucker, F. Dalpiaz, P. Giorgini, P. H. Meland, and E. Rios, Eds. Heidelberg: Springer-Verlag, 2014, pp. 192–202. doi: 10.1007/978-3-319-13518-2_13. Author copy: http://logicalhacking.com/publications/asim.ea-aniketos-monitoring-2014/
[14]
A. D. Brucker, F. Dalpiaz, P. Giorgini, P. H. Meland, and E. Rios, Eds., Secure and trustworthy service composition: The aniketos approach. Heidelberg: Springer-Verlag, 2014. doi: 10.1007/978-3-319-13518-2.
[15]
M. Salnitri, A. D. Brucker, and P. Giorgini, “From secure business process models to secure artifact-centric specifications,” in Enterprise, business-process and information systems modeling BPMDS, 2015, pp. 246–262. doi: 10.1007/978-3-319-19237-6_16. Author copy: http://logicalhacking.com/publications/salnitri.ea-river-2015/
[16]
A. D. Brucker, B. Zhou, F. Malmignati, Q. Shi, and M. Merabti, “Modelling, validating, and ranking of secure service compositions,” Software: Practice and Expierence (SPE), vol. 47, pp. 1912–1943, Dec. 2017, doi: 10.1002/spe.2513. Author copy: http://logicalhacking.com/publications/brucker.ea-secure-services-2017/
[17]
M. Asim, A. Yautsiukhin, A. D. Brucker, T. Baker, Q. Shi, and B. Lempereur, “Security policy monitoring of BPMN-based service compositions,” Journal of Software: Evolution and Process, 2018, doi: 10.1002/smr.1944. Author copy: http://logicalhacking.com/publications/asim.ea-policy-monitoring-2018/