Automated certification for compliant cloud-based business processes;Automatisierte compliance-zertifizierung cloud-basierter geschäftsprozesse

Business and Information Systems Engineering

Volumn 53, Issue 3, 2011, Pages 139-149

  Accorsi, Rafael ^a   Lowis, Lutz ^a   Sato, Yoshinori ^b  

^a UNIVERSITY OF FREIBURG   (Germany)

^b Yokohama Research Laboratory   (Japan)

Author keywords

Audit; Business process models; Cloud computing; Compliance certification; Petri nets

Indexed keywords

EID: 84856273290     PISSN: None     EISSN: 18670202     Source Type: Journal    
DOI: 10.1007/s11576-011-0269-z     Document Type: Article

References (51)

1. Accorsi R, Wonnemann C (2011) Strong nonleak guarantees for workflow models. ACM, SACS, S. 308-314
2. Atluri V, Chun SA, Mazzoleni P (2001) A Chinese wall security model for decentralized workflow systems. ACM conference on computer and communications security. ACM, New York, S 48-57
3. BDSG (2009) Bundesdatenschutzgesetz. German Federal Ministry of Justice
4. Breaux TD, Antón AI (2008) Analyzing regulatory rules for privacy and security requirements. IEEE Trans Software Eng 34(1):5-20 (Pubitemid 351343899)
5. Breaux TD (2009) Legal requirements acquisition for the specification of legally compliant information systems. PhD thesis, North Carolina State University
6. Cabanillas C, Resinas M, Ruiz-Cortés A (2010) Hints on howto face business process compliance. In: Resinas M, Ruiz-Cortés A, Pastor JA, SanchoMR (Hrsg) Proc JISBD 4, S 26-32
7. Chow R, Golle P, Jakobsson M, Shi E, Staddon J, Masuoka R, Molina J (2009) Controlling data in the cloud: Outsourcing computation without outsourcing control. In: Proc 2009 ACM workshop on cloud computing security. ACM, New York, S 85-90
8. COMPAS (2008) Compliance-driven models, languages, and architectures for services. EU FP7 Project 215175, deliverable 2.1State of the art in the field of compliance languages
9. CSA (2009) Security guidance for critical areas of focus in cloud computing. Cloud Security Alliance. http://www. cloudsecurityalliance.org/. Abruf am 2010-06-29
10. CSA (2010) Top threats to cloud computing. Cloud Security Alliance. http://www. cloudsecurityalliance.org/. Abruf am 2010- 06-29
11. Curtis B, Kellner MI, Over J (1992) Process modeling. Comm ACM 35(9):75-90 (Pubitemid 23584400)
12. Dijkman R, Dumas M, Ouyang C (2008) Semantics and analysis of business process models in BPMN. Information & Software Technology 50(12):1281-1294
13. Ehrig M, Koschmider A, Oberweis A (2007) Measuring similarity between semantic business processmodels. ACS CRPIT 67:71-80
14. Etro F (2009) The economic impact of cloud computing on business creation, employment and output in Europe. Review of Business and Economics 54(2):179-218
15. European Commission (1995) Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data
16. ENISA (2009) Cloud computing - benefits, risks and recommendations for information security. European Network Information and Security Agency
17. Ghose A, Koliadis G (2007) Auditing business process compliance. Springer LNCS 4749:168-180
18. GLB (1999) Gramm-Leach-Bliley Act. In: Congress of the USA
19. Governatori G, Hoffmann J, Sadiq SW,Weber I (2009) Detecting regulatory compliance for business processmodels through semantic annotations. Springer LNBPI 14:5-17
20. Hayes B (2009) Cloud computing. CommACM 51(7):9-11
21. HIPAA (1996) Health insurance portability and accountability act. In: Congress of the USA
22. Höhn S (2009) Model-based reasoning on the achievement of business goals. In: ACM symposium on applied computing. ACM, New York, S 1589-1593
23. Huang H, Kirchner H (2009) Componentbased security policy design with colored Petri nets. Springer LNCS 5700:21-42
24. IIG (2010) BW2PN: BPEL+WSDL to Petri net transformation. Software tool developed at the University of Freiburg, IIG Telematics. http://www.telematik. uni-freiburg.de/ comcert/. Abruf am 2010-06-29
25. Katt B, Zhang X, Hafner M (2009) Towards a usage control policy specification with Petri nets. Springer LNCS 5871:905-912
26. Lampson B (1973) A note on the confinement problem. Commun ACM 16(10):613-615
27. Liu Y, Müller S, Xu K (2007) A static compliance-checking approach framework for business process models. IBM System Journal 46(2):335-361 (Pubitemid 46915268)
28. Liu R, Kumar A (2005) An analysis and taxonomy of unstructured workflows. Springer LNCS 3649:268-284
29. Lohmann N, Verbeek E, Dijkman RM (2009) Petri net transformations for business processes - A survey. Springer LNCS 5460:46-63
30. Lowis L, Accorsi R (2010) Vulnerability analysis in SOA-based business processes. IEEE Transactions on Services Computing (in press)
31. Meda HS, Sen AK, Bagchi A (2010) On detecting data flowerrors inworkflows. Journal of Data and Information Quality 2(1):1-31
32. Monakova G, Kopp O, Leymann F, Moser S, Schäfers K (2009) Verifying business rules using a SMT solver for BPEL processes. GI LNI 147:81-94
33. Murata T (1989) Petri nets: Properties, analysis and applications. Proc IEEE 77(4):541-580
34. Organisation for Economic Co-Operation and Development (OECD) (1980) OECD guidelines on the protection of privacy and transborder flows of personal data
35. Oryx (2010) The Oryx project. http://bpt.hpi. uni-potsdam.de/Oryx/ WebHome. Abruf am 2010-06-29
36. Ouyang C, Verbeek E, van der Aalst WMP, Breutel S, Dumas M, ter Hofstede AHM (2005) WofBPEL: A tool for automated analysis of BPEL processes. Springer LNCS 3826:484-489
37. Park J, Sandhu R (2004) The UCONABC usage control model. ACM Transactions on Information and System Security 7:128-174
38. Pretschner A, Hilty M, Basin D (2006) Distributed usage control. Comm ACM 49:39-44 (Pubitemid 44371759)
39. Sadiq S, Governatori G, Namiri K (2007) Modeling control objectives for business process compliance. Business Process Management. Springer LNCS 4714:149-164
40. Saha D (2008) A hitchhiker's guide to galaxy a.k.a. Netweaver business process modelling. http://www.sdn.sap.com/irj/scn/ weblogs?blog=/pub/wlg/10947. Abruf am 2010-06-29
41. Schneider F (2000) Enforceable security policies. ACM Trans Inf Syst Secur 3(1):30-50
42. SOX (2002) Sarbanes-Oxley act. In: Congress of the USA
43. Stohr EA, Zhao JL (2001) Workflow automation: Overview and research issues. Information Systems Frontiers 3(3):281-296
44. Svirskas A, Courbis C, Molva R, Bedinskas J (2007) Compliance proofs for collaborative interactions using aspect-oriented approach. IEEE Congress on Services 1:33-40
45. TMG (2009) Telemediengesetz. German Federal Ministry of Justice
46. Trčka N, van der AalstWMP, Sidorova N (2009) Data-flow anti-patterns: Discovering dataflow errors in workflows. Springer LNCS 5565:425-439
47. van der Aalst WMP (1998) The application of Petri nets to workflow management. Journal of Circuits, Systems, and Computers 8(1):21-66 (Pubitemid 128540249)
48. van der Aalst WMP (2003) Challenges in business process management: Verification of business processing using Petri nets. Bulletin of the EATCS 80:174-199
49. van Dongen BF, Jansen-Vullers MH, Verbeek HMW, van der Aalst WMP (2007) Verification of the SAP referencemodels using EPC reduction, state-space analysis, and invariants. Computers in Industry 58(6):578-601 (Pubitemid 46802841)
50. Wagner G (2002) Howto design a general rule markup language. GI LNI 14:19-37
51. Wong PYH, Gibbons J (2008) Verifying business process compatibility. In: International conference on quality software. IEEE, S 126-131