Skip to main content
SpringerLink
Log in

Automated Certification for Compliant Cloud-based Business Processes

  • Research Paper
  • Published:
Business & Information Systems Engineering Aims and scope Submit manuscript

Abstract

A key problem in the deployment of large-scale, reliable cloud computing concerns the difficulty to certify the compliance of business processes operating in the cloud. Standard audit procedures such as SAS-70 and SAS-117 are hard to conduct for cloud-based processes. The paper proposes a novel approach to certify the compliance of business processes with regulatory requirements. The approach translates process models into their corresponding Petri net representations and checks them against requirements also expressed in this formalism. Being based on Petri nets, the approach provides well-founded evidence on adherence and, in case of noncompliance, indicates the possible vulnerabilities.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5

Similar content being viewed by others

References

  • Accorsi R, Wonnemann C (2011) Strong non-leak guarantees for workflow models. ACM, SAC, pp. 308–314

  • Atluri V, Chun SA, Mazzoleni P (2001) A Chinese wall security model for decentralized workflow systems. ACM conference on computer and communications security. ACM, New York, pp 48–57

    Google Scholar 

  • BDSG (2009) Bundesdatenschutzgesetz. German Federal Ministry of Justice

  • Breaux TD, Antón AI (2008) Analyzing regulatory rules for privacy and security requirements. IEEE Trans Software Eng 34(1):5–20

    Article  Google Scholar 

  • Breaux TD (2009) Legal requirements acquisition for the specification of legally compliant information systems. PhD thesis, North Carolina State University

  • Cabanillas C, Resinas M, Ruiz-Cortés A (2010) Hints on how to face business process compliance. In: Resinas M, Ruiz-Cortés A, Pastor JA, Sancho MR (eds) Proc JISBD 4, pp 26–32

    Google Scholar 

  • Chow R, Golle P, Jakobsson M, Shi E, Staddon J, Masuoka R, Molina J (2009) Controlling data in the cloud: outsourcing computation without outsourcing control. In: Proc 2009 ACM workshop on cloud computing security. ACM, New York, pp 85–90

    Chapter  Google Scholar 

  • COMPAS (2008) Compliance-driven models, languages, and architectures for services. EU FP7 Project 215175, deliverable 2.1 “State of the art in the field of compliance languages”

  • CSA (2009) Security guidance for critical areas of focus in cloud computing. Cloud Security Alliance. http://www.cloudsecurityalliance.org/. Accessed 2010-06-29

  • CSA (2010) Top threats to cloud computing. Cloud Security Alliance. http://www.cloudsecurityalliance.org/. Accessed 2010-06-29

  • Curtis B, Kellner MI, Over J (1992) Process modeling. Comm ACM 35(9):75–90

    Article  Google Scholar 

  • Dijkman R, Dumas M, Ouyang C (2008) Semantics and analysis of business process models in BPMN. Information & Software Technology 50(12):1281–1294

    Article  Google Scholar 

  • Ehrig M, Koschmider A, Oberweis A (2007) Measuring similarity between semantic business process models. ACS CRPIT 67:71–80

    Google Scholar 

  • Etro F (2009) The economic impact of cloud computing on business creation, employment and output in Europe. Review of Business and Economics 54(2):179–218

    Google Scholar 

  • European Commission (1995) Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data

  • ENISA (2009) Cloud computing—benefits, risks and recommendations for information security. European Network Information and Security Agency

  • Ghose A, Koliadis G (2007) Auditing business process compliance. Springer LNCS 4749:168–180

    Google Scholar 

  • GLB (1999) Gramm-Leach-Bliley Act. In: Congress of the USA

    Google Scholar 

  • Governatori G, Hoffmann J, Sadiq SW, Weber I (2009) Detecting regulatory compliance for business process models through semantic annotations. Springer LNBPI 14:5–17

    Google Scholar 

  • Hayes B (2009) Cloud computing. Comm ACM 51(7):9–11

    Article  Google Scholar 

  • HIPAA (1996) Health insurance portability and accountability act. In: Congress of the USA

    Google Scholar 

  • Höhn S (2009) Model-based reasoning on the achievement of business goals. In: ACM symposium on applied computing. ACM, New York, pp 1589–1593

    Google Scholar 

  • Huang H, Kirchner H (2009) Component-based security policy design with colored Petri nets. Springer LNCS 5700:21–42

    Google Scholar 

  • IIG (2010) BW2PN: BPEL+WSDL to Petri net transformation. Software tool developed at the University of Freiburg, IIG Telematics. http://www.telematik.uni-freiburg.de/comcert/. Accessed 2010-06-29

  • Katt B, Zhang X, Hafner M (2009) Towards a usage control policy specification with Petri nets. Springer LNCS 5871:905–912

    Google Scholar 

  • Lampson B (1973) A note on the confinement problem. Commun ACM 16(10):613–615

    Article  Google Scholar 

  • Liu Y, Müller S, Xu K (2007) A static compliance-checking approach framework for business process models. IBM System Journal 46(2):335–361

    Article  Google Scholar 

  • Liu R, Kumar A (2005) An analysis and taxonomy of unstructured workflows. Springer LNCS 3649:268–284

    Google Scholar 

  • Lohmann N, Verbeek E, Dijkman RM (2009) Petri net transformations for business processes—A survey. Springer LNCS 5460:46–63

    Google Scholar 

  • Lowis L, Accorsi R (2010) Vulnerability analysis in SOA-based business processes. IEEE Transactions on Services Computing (in press)

  • Meda HS, Sen AK, Bagchi A (2010) On detecting data flow errors in workflows. Journal of Data and Information Quality 2(1):1–31

    Article  Google Scholar 

  • Monakova G, Kopp O, Leymann F, Moser S, Schäfers K (2009) Verifying business rules using a SMT solver for BPEL processes. GI LNI 147:81–94

    Google Scholar 

  • Murata T (1989) Petri nets: properties, analysis and applications. Proc IEEE 77(4):541–580

    Article  Google Scholar 

  • Organisation for Economic Co-Operation and Development (OECD) (1980) OECD guidelines on the protection of privacy and transborder flows of personal data

  • Oryx (2010) The Oryx project. http://bpt.hpi.uni-potsdam.de/Oryx/WebHome. Accessed 2010-06-29

  • Ouyang C, Verbeek E, van der Aalst WMP, Breutel S, Dumas M, ter Hofstede AHM (2005) WofBPEL: a tool for automated analysis of BPEL processes. Springer LNCS 3826:484–489

    Google Scholar 

  • Park J, Sandhu R (2004) The UCONABC usage control model. ACM Transactions on Information and System Security 7:128–174

    Article  Google Scholar 

  • Pretschner A, Hilty M, Basin D (2006) Distributed usage control. Comm ACM 49:39–44

    Article  Google Scholar 

  • Sadiq S, Governatori G, Namiri K (2007) Modeling control objectives for business process compliance. Business process management. Springer LNCS 4714:149–164

    Google Scholar 

  • Saha D (2008) A hitchhiker’s guide to galaxy a.k.a. Netweaver business process modelling. http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/10947. Accessed 2010-06-29

  • Schneider F (2000) Enforceable security policies. ACM Trans Inf Syst Secur 3(1):30–50

    Article  Google Scholar 

  • SOX (2002) Sarbanes-Oxley act. In: Congress of the USA

    Google Scholar 

  • Stohr EA, Zhao JL (2001) Workflow automation: overview and research issues. Information Systems Frontiers 3(3):281–296

    Article  Google Scholar 

  • Svirskas A, Courbis C, Molva R, Bedžinskas J (2007) Compliance proofs for collaborative interactions using aspect-oriented approach. IEEE Congress on Services 1:33–40

    Article  Google Scholar 

  • TMG (2009) Telemediengesetz. German Federal Ministry of Justice

  • Trčka N, van der Aalst WMP, Sidorova N (2009) Data-flow anti-patterns: discovering data-flow errors in workflows. Springer LNCS 5565:425–439

    Google Scholar 

  • van der Aalst WMP (1998) The application of Petri nets to workflow management. Journal of Circuits, Systems, and Computers 8(1):21–66

    Article  Google Scholar 

  • van der Aalst WMP (2003) Challenges in business process management: verification of business processing using Petri nets. Bulletin of the EATCS 80:174–199

    Google Scholar 

  • van Dongen BF, Jansen-Vullers MH, Verbeek HMW, van der Aalst WMP (2007) Verification of the SAP reference models using EPC reduction, state-space analysis, and invariants. Computers in Industry 58(6):578–601

    Article  Google Scholar 

  • Wagner G (2002) How to design a general rule markup language. GI LNI 14:19–37

    Google Scholar 

  • Wong PYH, Gibbons J (2008) Verifying business process compatibility. In: International conference on quality software. IEEE, pp 126–131

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. IIG Telematics, University of Freiburg, Friedrichstr. 50, 79098, Freiburg, Germany

    Rafael Accorsi &  Lutz Lowis

  2. Yokohama Research Laboratory, Hitachi, 292 Yoshida-cho, Totsuka-ku, Yokohama, 244-0817, Kanagawa, Japan

    Yoshinori Sato

Authors
  1. Rafael Accorsi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Lutz Lowis
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Yoshinori Sato
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Rafael Accorsi.

Additional information

Accepted after three revisions by Prof. Dr. Müller.

This article is also available in German in print and via http://www.wirtschaftsinformatik.de: Accorsi R, Lowis L, Sato Y (2011) Automatisierte Compliance-Zertifizierung Cloud-basierter Geschäftsprozesse. WIRTSCHAFTSINFORMATIK. doi: 10.1007/s11576-011-0269-z.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Accorsi, R., Lowis, L. & Sato, Y. Automated Certification for Compliant Cloud-based Business Processes. Bus Inf Syst Eng 3, 145–154 (2011). https://doi.org/10.1007/s12599-011-0155-7

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12599-011-0155-7

Keywords

Search

Navigation