Secure business process model specification through a UML 2.0 activity diagram profile

Decision Support Systems

Volumn 51, Issue 3, 2011, Pages 446-465

  Rodríguez, Alfonso ^a   Fernández Medina, Eduardo ^b   Trujillo, Juan ^c   Piattini, Mario ^b  

^a UNIVERSIDAD DEL BÍO BÍO   (Chile)

^b UNIVERSITY OF CASTILLA LA MANCHA   (Spain)

^c UNIVERSITY OF ALICANTE   (Spain)

Author keywords

Activity diagrams; Business process; Security requirement; UML 2.0

Indexed keywords

ACTIVITY DIAGRAM; BUSINESS ANALYSTS; BUSINESS PROCESS; BUSINESS PROCESS MODEL; BUSINESS PROCESS MODELING; EXAMPLE BASED; MODEL DRIVEN ARCHITECTURES; PLATFORM INDEPENDENT; SECURITY REQUIREMENT; SECURITY REQUIREMENTS; SOFTWARE DEVELOPMENT; UML 2.0; UML EXTENSION;

COMPETITION; HEALTH CARE; SOFTWARE DESIGN; SPECIFICATIONS; SYSTEMS ANALYSIS;

MATHEMATICAL MODELS;

EID: 79955884819     PISSN: 01679236     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.dss.2011.01.018     Document Type: Article

References (59)

1. R.S. Aguilar-Savén Business process modelling: review and framework International Journal of Production Economics 90 2 2004 129 149
2. V. Atluri Security for workflow systems Information Security Technical Report 6 2 2001 59 68 (Pubitemid 33663939)
3. M. Backes, B. Pfitzmann, and M. Waider Security in business process engineering International Conference on Business Process Management (BPM), Eindhoven, Netherlands 2003
4. R. Baskerville, and T. Wood-Harper A critical perspective on action research as a method for information systems research Journal of Information Technology 11 1996 235 246
5. J. Bézivin In search of a basic principle for model driven engineering UPGRADE, European Journal for the Informatics Professional V 2 2004 21 24
6. J. Bézivin On the unification power of models Software and Systems Modeling 4 2 2005 171 188 (Pubitemid 40736678)
7. H.K. Bhargava, D.J. Power, and D. Sun Progress in web-based decision support technologies Decision Support Systems 43 2007 1083 1095 (Pubitemid 47223452)
8. BPMN, Business Process Modeling Notation Specification OMG Final Adopted Specification, dtc/06-02-01 2006
9. R.M. Davison, M.G. Martinsons, and N. Kock Principles of canonical action research Information Systems Journal 14 2004 65 86 (Pubitemid 38087028)
10. Rachna Dhamija, J.D. Tygar, and Marti Hearst Why phishing works SIGCHI Conference on Human Factors in Computing Systems 2006 ACM Montreal, Quebec, Canada
11. M.H. Diallo, J. Romero-Mariona, S.E. Sim, T.A. Alspaugh, and D.J. Richardson A comparative evaluation of three approaches to specifying security requirements 12th International Working Conference on Requirements Engineering: Foundation for Software Quality (REFSQ), Luxembourg 2006
12. A. Dutta, and S. Heda Information systems architecture to support managed care business processes Decision Support Systems 30 2000 217 225
13. H.-E. Eriksson, and M. Penker Business Modeling with UML.RN 2001
14. D. Firesmith Engineering security requirements Journal of Object Technology 2 1 January-February 2003 53 68
15. D. Firesmith Specifying reusable security requirements Journal of Object Technology 3 1 January-February 2004 61 75
16. L. Fuentes, and A. Vallecillo An introduction to UML profiles UPGRADE, The European Journal for the Informatics Professional 2 2 2004 6 13
17. A. Gregoriades, and B. Karakostasb Unifying business objects and system dynamics as a paradigm for developing decision support systems Decision Support Systems 37 2004 307 311
18. C.B. Haley, R.C. Laney, and B. Nuseibeh Deriving security requirements from crosscutting threat descriptions 3rd International Conference on Aspect-Oriented Software Development (AOSD), Lancaster, UK 2004
19. P. Harmon The OMG's model driven architecture and BPM Business Process Trends 2 5 2004
20. G. Herrmann, and G. Pernul Towards security semantics in workflow management Thirty-First Annual Hawaii International Conference on System Sciences, Kohala Coast, Hawaii, USA 1998
21. G. Herrmann, and G. Pernul Viewing business process security from different perspectives 11th International Bled Electronic Commerce Conference, Slovenia 1998
22. P. Herrmann, and G. Herrmann Security requirement analysis of business processes Electronic Commerce Research 6 3-4 2006 305 335 (Pubitemid 44488792)
23. S. Houmb, S. Islam, E. Knauss, J. Jürjens, and K. Schneider Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and Umlsec Requirements Engineering (Special Issue - Security Requirements Engineering) 2010(15) 2010 63
24. S.-M. Huang, D.C. Yen, Y.-C. Hung, Y.-J. Zhou, J.-S. Hua, A business process gap detecting mechanism between information system process flow and internal control flow. Decision Support Systems 47 (2009) 436-454.
25. I. Jacobson, G. Booch, and J. Rumbaugh The Unified Software Development Process 1999 463
26. J. Jürjens Developing Secure Systems with UMLsec - From Business Processes to Implementation in VIS 2001 2001 Vieweg-Verlag Kiel (Germany)
27. J. Jürjens Model-based security engineering with UML A. Aldini, R. Gorrieri, F. Martinelli, Foundations of Security Analysis and Design III 2005 Springer Verlag
28. J. Jürjens, Secure Systems Development with UML, ed. Springer Verlag. 2005.
29. A. Kalnins, J. Barzdins, and E. Celms UML business modeling profile Thirteenth International Conference on Information Systems Development, Advances in Theory, Practice and Education, Vilnius, Lithuania 2004
30. B. Kitchenham Guideline for Performing Systematic Literature Reviews in Software Engineering. Version 2.3. RN 2007
31. B. Korherr, and B. List Extending the UML 2 activity diagram with business process goals and performance measures and the mapping to BPEL 2nd International Workshop on Best Practices of UML (BP-UML) at ER Conference, Tucson, Arizona, USA 2006
32. B.W. Lampson Computer security in the real world IEEE Computer 37 6 2004 37 46
33. B. List, and B. Korherr An evaluation of conceptual business process modelling languages ACM Symposium on Applied Computing (SAC), Dijon, France 2006
34. B. List, and B. Korherr A UML 2 profile for business process modelling 1st International Workshop on Best Practices of UML (BP-UML) at ER-Conference, Klagenfurt, Austria 2005
35. T. Lodderstedt, D. Basin, and J. Doser SecureUML: a UML-based modeling language for model-driven security UML, 5th International Conference, Dresden, Germany 2002
36. A. Lonjon Business Process Modeling and Standardization BPTrends 2004 http://www.bptrends.com/
37. A. Maña, J.A. Montenegro, C. Rudolph, and J.L. Vivas A business process-driven approach to security engineering 14th International Workshop on Database and Expert Systems Applications (DEXA), Prague, Czech Republic 2003
38. N.R. Mead Experiences in eliciting security requirements CrossTalk: The Journal of Defense Software Engineering Vol. 19(12) 2006
39. D. Mellado, C. Blanco, L.E. Sánchez, and E. Fernández- Medina A systematic review of security requirements engineering Computer Standards & Interfaces 32 4 2010 153 165
40. T. Mens, and P. Van Gorp A taxonomy of model transformation Electronic Notes in Theoretical Computer Science 152 2006 125 142
41. A. Oberweis An integrated approach for the specification of processes and related complex structured objects in business applications Decision Support Systems 17 1996 31 53 (Pubitemid 126374788)
42. Object Management Group MDA Guide Version 1.0.1 2003
43. Object Management Group Unified Modeling Language Specification. Version 1.5 2003
44. Object Management Group Unified Modeling Language: Superstructure Version 2.1.1 (formal/2007-02-05) 2007
45. V. Portougal, and D. Sundaram Business Processes: Operational Solutions for SAP Implementation by 2005 2005 329
46. QVT, Meta Object Facility (MOF) 2.0 Query/View/Transformation Specification, ed. OMG Adopted Specification ptc/05-11-01. 2005. 204.
47. A. Rodríguez, E. Fernández-Medina, and M. Piattini Analysis-level classes from secure business processes through models transformations 4th International Conference on Trust, Privacy and Security in Digital Business (TrustBus), Regensburg, Germany 2007
48. A. Rodríguez, E. Fernández-Medina, and M. Piattini CIM to PIM transformation: a reality IFIP International Conference on Research and Practical Issues of Enterprise Information Systems (CONFENIS), Beijing, China 2007
49. A. Rodríguez, E. Fernández-Medina, and M. Piattini M-BPSec: a method for security requirement elicitation from a UML 2.0 business process specification 3rd International Workshop on Foundations and Practices of UML, Auckland, New Zealand 2007
50. A. Rodríguez, E. Fernández-Medina, and M. Piattini Towards a UML 2.0 extension for the modeling of security requirements in business processes 3rd International Conference on Trust, Privacy and Security in Digital Business (TrustBus), Krakow-Poland 2006
51. A. Rodríguez, E. Fernández-Medina, and M. Piattini Towards CIM to PIM transformation: from secure business processes defined by BPMN to use cases 5th International Conference on Business Process Management (BPM), Brisbane, Australia 2007
52. A. Rodriguez, I. García-Rodríguez de Guzmán, E. Fernández-Medina, and M. Piattini Semi-formal transformation of secure business processes into analysis class and use case models: an MDA approach Information & Software Technology 52 9 2010 945 971
53. A.W. Röhm, G. Pernul, and G. Herrmann Modelling secure and fair electronic commerce 14th Annual Computer Security Applications Conference, Scottsdale, Arizona 1998
54. G. Sindre Mal-activity diagrams for capturing attacks on business processes Requirements Engineering: Foundation for Software Quality, 13th International Working Conference, REFSQ 2007, Trondheim, Norway 2007
55. L. Srinivasan, and J. Treadwell An Overview of Service-Oriented Architecture, Web Services and Grid Computing.RN http://h71028.www7.hp.com/ERC/ downloads/SOA-Grid-HP-WhitePaper.pdf 2005
56. V. Stefanov, B. List, and B. Korherr Extending UML 2 activity diagrams with business intelligence objects 7th International Conference on Data Warehousing and Knowledge Discovery (DaWaK2005), Copenhagen, Denmark 2005
57. V. Vitolins, and A. Kalnins Semantics of UML 2.0 activity diagram for business modeling by means of virtual machine Ninth IEEE International Enterprise Distributed Object Computing Conference (EDOC), Enschede, The Netherlands 2005
58. J.L. Vivas, J.A. Montenegro, and J. Lopez Towards a business process-driven framework for security engineering with the UML Boyd Colin, Mao Wenbo, Information Security: 6th International Conference, ISC, Bristol, U.K. 2003
59. A. Zuccato Holistic security requirement engineering for electronic commerce Computers & Security 23 1 2004 63 76