Semi-formal transformation of secure business processes into analysis class and use case models: An MDA approach

Information and Software Technology

Volumn 52, Issue 9, 2010, Pages 945-971

  Rodríguez, Alfonso ^a   Guzmán, Ignacio García Rodríguez de ^b   Fernández Medina, Eduardo ^b   Piattini, Mario ^b  

^a UNIVERSIDAD DEL BÍO BÍO   (Chile)

^b UNIVERSITY OF CASTILLA LA MANCHA   (Spain)

Author keywords

BPMN; MDA; Secure business processes; UML

Indexed keywords

ABSTRACT MODELS; ABSTRACTION LEVEL; ACTIVITY DIAGRAM; ALTERNATIVE APPROACH; BUSINESS PROCESS; BUSINESS PROCESS MODEL; BUSINESS PROCESS MODELLING; CLASS DIAGRAMS; ELECTRICAL ENERGY CONSUMPTION; FORMAL TRANSFORMATION; INFORMATION SYSTEMS DEVELOPMENT; ITERATIVE PROCESS; MDA APPROACH; META MODEL; MODEL DRIVEN ARCHITECTURES; MODEL-DRIVEN DEVELOPMENT; REAL ENVIRONMENTS; RESEARCH METHODS; SECURITY REQUIREMENTS; SEMI-AUTOMATICS; SET OF RULES; SOFTWARE DEVELOPMENT PROCESS; TRANSFORMATION RULES; UNIFIED MODELLING LANGUAGE; USE CASE DIAGRAM; USE CASE MODEL;

ABSTRACTING; COMPUTER SOFTWARE; GRAPHIC METHODS; MANAGEMENT INFORMATION SYSTEMS; SOFTWARE DESIGN; SPHERES; SYSTEMS ANALYSIS;

SOFTWARE ARCHITECTURE;

EID: 77953671395     PISSN: 09505849     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.infsof.2010.03.015     Document Type: Article

References (73)

1. A. Agrawal, GReAT: a metamodel based model transformation language, in: 18th IEEE International Conference on Automated Software Engineering, Montreal, Canada, 2003.
2. Aguilar-Savén R.S. Business process modelling: review and framework. International Journal of Production Economics 90 2 (2004) 129-149
3. D.H. Akehurst, B. Bordbar, M.J. Evans, W.G.J. Howells, K.D. McDonald-Maier, SiTra: simple transformations in Java, in: 9th International Conference on Model Driven Engineering Languages and Systems, Genova, Italy, 2006.
4. F. Allilaire, T. Idrissi, ADT: eclipse development tools for ATL, in: 2nd European Workshop on MDA, 2004.
5. G. Antoniol, M. Di penta, M. Zazzara, Understanding web applications through dynamic analysis, in: 12th IEEE International Workshop on Program Comprehension (IWPC), 2004.
6. M. Backes, B. Pfitzmann, M. Waider, Security in business process engineering, in: International Conference on Business Process Management (BPM), Eindhoven, Netherlands, 2003.
7. J.P. Barros, L. Gomes, From activity diagrams to class diagrams, in: Workshop Dynamic Behaviour in UML Models: Semantic Questions in Conjunction with Third International Conference on UML, York, UK, 2000.
8. Basin D., Doser J., and Lodderstedt T. Model driven security: from UML models to access control infrastructures. ACM Transactions on Software Engineering and Methodology 15 1 (2006) 39-91
9. Baskerville R., and Wood-Harper T. A critical perspective on action research as a method for information systems research. Journal of Information Technology 11 (1996) 235-246
10. Bézivin J. Search of a basic principle for model driven engineering. UPGRADE European Journal for the Informatics Professional V 2 (2004) 21-24
11. J. Bézivin, F. Jouault, P. Valduriez, An Eclipse-based IDE for the ATL Model Transformation Language, RN, 2005.
12. BPMN, Business Process Modeling Notation Specification, OMG Final Adopted Specification, dtc/06-02-01, 2006.
13. P. Braun, F. Marschall, The Bidirectional Object Oriented Transformation Language, RN, 2003.
14. R. Breu, M. Hafner, F. Innerhofer-Oberperfler, F. Wozak, Model-driven security engineering of service oriented systems, in: Information Systems and e-Business Technologies, 2nd International United Information Systems Conference (UNISCON), 2008.
15. K.-K.R. Choo, R.G. Smith, R. McCusker, and C.h.w.a.g.a.p.r., Australian Institute of Criminology, future directions in technology-enabled crime: 2007-09, Research and Public Policy Series Edited by Australian Institute of Criminology, vol. 78, 2007.
16. Davison R.M., Martinsons M.G., and Kock N. Principles of canonical action research. Information Systems Journal 14 (2004) 65-86
17. R.M. Dijkman, S.M.M. Joosten, An algorithm to derive use cases from business processes, in: 6th International Conference on Software Engineering and Applications (SEA), Boston, USA, 2002.
18. T. Dufresne, J. Martin, Process Modeling for e-Business, RN, 2003.
19. J.R. Falleri, M. Huchard, C. Nebut, Towards a traceability framework for model transformations in kermeta, in: European Conference on Model-Driven Architecture Traceability Workshop (ECMDA-TW), Bilbao, Spain, 2006.
20. Firesmith D. Security use case. Journal of Object Technology 2 3 (2003) 53-64
21. Firesmith D. Specifying reusable security requirements. Journal of Object Technology 3 1 (2004) 61-75
22. Giaglis G.M. A taxonomy of business process modelling and information systems modelling techniques. International Journal of Flexible Manufacturing Systems 13 2 (2001) 209-228
23. J.J. Gutiérrez, C. Nebut, M.J. Escalona, M. Mejías, I.M. Ramos, Visualization of use cases through automatically generated activity diagrams, in: 11th international conference on Model Driven Engineering Languages and Systems, 2008.
24. M. Hafner, M. Alam, R. Breu, Towards a MOF/QVT-based domain architecture for model driven security, in: Model Driven Engineering Languages and Systems, 2006.
25. Hafner M., and Breu R. Security Engineering for Service-Oriented Architectures (2009), Springer
26. Harmon P. The OMG's model driven architecture and BPM. Business Process Trends 2 5 (2004)
27. G. Herrmann, G. Pernul, Viewing business process security from different perspectives, in: 11th International Bled Electronic Commerce Conference, Slovenia, 1998.
28. Herrmann P., and Herrmann G. Security requirement analysis of business processes. Electronic Commerce Research 6 3-4 (2006) 305-335
29. F. Jouault, I. Kurtev, On the architectural alignment of ATL and QVT, in: ACM Symposium on Applied Computing - Model Transformation, Dijon, France, 2006.
30. F. Jouault, I. Kurtev, Transforming models with ATL, in: International Workshop on Model Transformations in Practice (MTiP), 2005.
31. King S.F., Johnson O.A., and BP V. An approach to modelling process variety and best practice. Information and Software Technology 48 11 (2006) 1104-1114
32. Kleppe A., Warmer J., and Bast W. MDA Explained: The Model Driven Architecture™: Practice and Promise (2003), Addison Wesley p. 192
33. P. Kobiakov, MDA and QVT in Together Architect 2006, 2005.
34. I. Kurtev, State of the art of QVT: a model transformation language standard, in: Applications of Graph Transformations with Industrial Relevance, Third International Symposium (AGTIVE), Kassel, Germany, 2007.
35. Kuznetsov M.B. UML model transformation and its application to MDA technology. Programming and Computer Software 33 1 (2007) 44-53
36. P. Liew, P. Kontogiannis, T. Tong, A framework for business model driven development, in: 12 International Workshop on Software Technology and Engineering Practice (STEP), 2004.
37. B. List, B. Korherr, A UML 2 profile for business process modelling, in: 1st International Workshop on Best Practices of UML (BP-UML) at ER-Conference, Klagenfurt, Austria, 2005.
38. O. Macek, K. Richta, The BPM to UML activity diagram transformation using XSLT, in: Databases, Texts, Specifications, and Objects (DATESO 2009), 2009.
39. A. Maña, J.A. Montenegro, C. Rudolph, J.L. Vivas, A business process-driven approach to security engineering, in: 14th. International Workshop on Database and Expert Systems Applications (DEXA), Prague, Czech Republic, 2003.
40. Mellor S.J., Scott K., Uhl A., and Weise D. MDA Distilled: Principles of Model-Driven Architecture (2004), A. Wesley p. 176
41. Mens T., and Van Gorp P. A taxonomy of model transformation. Electronic Notes in Theoretical Computer Science 152 (2006) 125-142
42. Object Management Group, Architecture-driven Modernization (ADM): Knowledge Discovery Metamodel (KDM) Specification, Object Management Group, 2006.
43. Object Management Group, Common Warehouse Metamodel (CWM) Specification, 2003.
44. Object Management Group, MDA Guide Version 1.0.1, 2003.
45. Object Management Group, Meta Object Facility (MOF) 2.0 Query/View/Transformation Specification, OMG Adopted Specification ptc/05-11-01, 2005, p. 204.
46. Object Management Group, Unified Modeling Language: Superstructure, Version 2.0, formal/05-07-04, 2005.
47. Object Management Group, Unified Modeling Language: Superstructure Version 2.1.1 (formal/2007-02-05), 2007.
48. OMG, Meta Object Facility (MOF) Specification, 2002.
49. OMG, OCL 2.0 Specification, Version 2.0., RN, 2005.
50. OMG, Unified Modeling Language: Superstructure, Versión 2.0, 2005.
51. G. Rader, C. Vo, Achieving consistency between business process models and operational guides, in: Rational Software. Enterprise Business Process Documentation (White Paper), 2008.
52. Robson C. Real World Research: A Resource for Social Scientists and Practitioner-Researchers. second ed. (2002), Blackwell, Oxford, UK
53. A. Rodríguez, E. Fernández-Medina, M. Piattini, Analysis-level classes from secure business processes through models transformations, in: 4th International Conference on Trust, Privacy and Security in Digital Business (TrustBus), Regensburg, Germany, 2007.
54. Rodríguez A., Fernández-Medina E., and Piattini M. A BPMN extension for the modeling of security requirements in business processes. IEICE Transactions on Information and Systems E90-D 4 (2007) 745-752
55. A. Rodríguez, E. Fernández-Medina, M. Piattini, Capturing security requirements in business processes through a UML 2.0 activity diagrams profile, in: 2° International Workshop on Best Practices of UML (BP-UML), 2006.
56. A. Rodríguez, E. Fernández-Medina, M. Piattini, M-BPSec: a method for security requirement elicitation from a UML 2.0 business process specification, in: 3rd International Workshop on Foundations and Practices of UML, Auckland, New Zealand, 2007.
57. A. Rodríguez, E. Fernández-Medina, M. Piattini. Towards a UML 2.0 extension for the modeling of security requirements in business processes, in: 3rd International Conference on Trust, Privacy and Security in Digital Business (TrustBus), Krakow-Poland, 2006.
58. A. Rodríguez, E. Fernández-Medina, M. Piattini. Towards CIM to PIM transformation: from Secure Business Processes defined by BPMN to Use Cases. in: 5th International Conference on Business Process Management (BPM), Brisbane, Australia, 2007.
59. A.W. Röhm, G. Herrmann, G. Pernul, A language for modelling secure business transactions, in: 15th. Annual Computer Security Applications Conference, Phoenix, Arizona, 1999.
60. A.W. Röhm, G. Pernul, G. Herrmann, Modelling secure and fair electronic commerce, in: 14th Annual Computer Security Applications Conference, Scottsdale, Arizona, 1998.
61. Runeson P., and Höst M. Guidelines for conducting and reporting case study research in software engineering. Empirical Software Engineering 14 2 (2009) 131-161
62. Rungworawut W., and Senivongse T. A guideline to mapping business processes to UML class diagrams. WSEAS Transactions on Computers 4 11 (2005) 1526-1533
63. Rungworawut W., and Senivongse T. Using ontology search in the design of class diagram from business process model. Enformatika, Transactions on Engineering, Computing and Technology 12 (2006) 165-170
64. G. Sindre, Mal-activity diagrams for capturing attacks on business processes, in: Requirements Engineering: Foundation for Software Quality, 13th International Working Conference, REFSQ 2007, Trondheim, Norway, 2007.
65. SOURCEFORGE, UMT-QVT, 2005.
66. S. Štolfa, I. Vondrák, A description of business process modeling as a tool for definition of requirements specification, in: Systems Integration 12th Annual International Conference, Prague, Czech Republic, 2004.
67. J.L. Vivas, J.A. Montenegro, J. Lopez, Towards a business process-driven framework for security engineering with the UML, in: Colin Boyd, Wenbo Mao (Eds.), Information Security: 6th International Conference, ISC, Bristol, UK, 2003.
68. J.P. Walton, Developing a enterprise information security policy, in: Proceedings of the 30th Annual ACM SIGUCCS Conference on User Services, ACM Press, 2002.
69. WfMC, Workflow Management Coalition: Terminology & Glossary, RN, 1999. .
70. S.A. White, Process Modeling Notations and Workflow Patterns, 2004, BPTrends, March 2004.
71. C. Wolter, A. Schaad, modeling of task-based authorization constraints in BPMN, in: 5th International Conference on Business Process Management, 2007.
72. C. Wolter, A. Schaad, C. Meinel, Deriving XACML policies from business process models, in: WISE Workshops, 2007.
73. Zulkernine M., and Ahamed S.I. Software security engineering: toward unifying software engineering and security engineering. In: Warkentin M., and Vaughn R. (Eds). Enterprise Information Systems Assurance and Systems Security: Managerial and Technical Issues (2006), Idea Group 215-232