OPBUS: A framework for improving the dependability of risk-aware business processes

(1) Diagnosis of non-conformance of risks in business process models. Our contribution consists on two parts: (1) transformation of business processes onto risk-aware business process models by providing a risk model as an extension of these models; and (2) the provisioning of verification methods for the risk assessment of business process models, and for the diagnosis of tasks whose risks are non-conformant with regard to acceptable risk level.

Firstly, we propose a light extension to business process models [2] that enables the risk identification, risk estimation and the establishment of business objectives of the business process tasks and artifacts. Risk assessment strives to compute the risks (risk estimation) in order to evaluate (risk evaluation) whether risks are acceptable in accordance with business objectives. Automatic techniques are provided [5] in order to perform risk estimation and risk evaluation of an entire business process. We propose computing risk estimation based on various control-flow patterns [2]. Thereafter, risk estimation and business processes are diagnosed in order to identify which elements within the model are non-conformant to the expected risk criteria. In order to automate risk estimation and the risk evaluation we provide a verification mechanism that enables the Model-Based Diagnosis (MDB) and Constraint Programming (CP) techniques to automate it. Thus, business process models and their extensions are transformed into constraint programs that are evaluated using a constraint solver. The constraint solver evaluates the model by providing a result of non-conformance or conformance of the business process. If there is any non-conformance, then the elements of the business process model involved in the non-conformance are isolated by means of an exoneration process.

(2) Generation and selection of optimal configurations for security controls present a big challenge in business process management systems since there is a vast list of IT controls that must be set up with a large number of configurations. This heterogeneity makes difficult to ensure the effectiveness of the configuration with regard to organizational requirements. This contribution [6] firstly provides a formalization of IT security countermeasures for business processes based on security patterns and feature models for the representation countermeasures. Subsequently, a catalogue of IT security countermeasures have been formalized [4] to enforce confidentiality, integrity, availability and authentication in business processes management systems. Feature-Oriented Domain Analysis (FODA) have been applied [4] over the catalogue of security patterns for the inference, selection, and generation of optimal configurations with regard to single and multiple objectives. In order to automate FODA, CP techniques have been used where two different analyses have been carried out. A first analysis consisted of obtaining the total number of configurations regardless of attributes and extra functionalities; moreover, a model consistency operation has been applied to the models in order to detect possible void feature models. Subsequently, a second analysis consisted of applying optimized searches has been applied to achieve specific configurations with regard to one or multiple objective functions.

(3) Deployment fault tolerance infrastructure. Business processes must be deployed after selecting countermeasures. Despite countermeasures, business processes could still have faults (such as zero-day vulnerabilities) during run-time hence these processes could be affected by unexpected faults. The contribution presents a fault tolerance layer [3] (cf. Chapter 6), that may be integrated into a business process management system, composed of two main stages: (1) an error detection mechanism based on business rules and MDB using CP techniques for the detection and isolation of faulty components; (2) definition of various fault tolerance patterns based on replication and redundancy, dynamic binding of services, check-pointing and roll-back, and diversity. Error detection mechanisms compare the results of the business process with the results of the business rules. In the case of any discrepancy, the MDB is applied in order to detect and isolate which components of the business process are responsible. Once faulty components are identified, error detection stage communicates the decision to recovery stage to release a recovery mechanism.