Modeling and Verifying Security Policies in Business Processes

Abstract

Modern information systems are large-sized and comprise multiple heterogeneous and autonomous components. Autonomy enables decentralization, but it also implies that components providers are free to change, retire, or introduce new components. This is a threat to security, and calls for a continuous verification process to ensure compliance with security policies. Existing verification frameworks either have limited expressiveness-thereby inhibiting the specification of real-world requirements-, or rely on formal languages that are hardly employable for modeling and verifying large systems. In this paper, we overcome the limitations of existing approaches by proposing a framework that enables: (1) specifying information systems in SecBPMN, a security-oriented extension of BPMN; (2) expressing security policies through SecBPMN-Q, a query language for representing security policies; and (3) verifying SecBPMN-Q against SecBPMN specifications via an implemented query engine. We report on the applicability of our approach via a case study about air traffic management.

Modeling and verification of ATM security policies with SecBPMN

“…SecBPMN [10] is framework for modeling business processes with security aspects, to model security policies and to verify if such security policies are satisfies by the business processes. It is composed by: SecBPMN-ml, SecBPMN-Q and a software components.…”

“…Assuming the predicates that details the security annotations of the security policy are less restrictive of the predicates of the business process, the business process satisfies the security policy. For further details, please refer to [10].…”

“…In [10], we have introduced SecBPMN, a framework composed of a language for modeling business processes including security concerns, called SecBPMN-ml ( SecBPMN-modeling language), a query language for specifying security policies, called SecBPMN-Q (SecBPMN-Query) and a software which permits to verify whether a SecBPMN-Q security policy is satisfied by a SecBPMN-ml business process. In this paper, we illustrate the application of SecBPMN to the SWIM a ATM case study.…”

From Secure Business Process Models to Secure Artifact-Centric Specifications

“…It requires a system to ensure completeness, accuracy and absence of unauthorized modifications in all its components [8]. It can be linked to one task, data object or message flow (Tab.…”

“…SecBPMN [8] and SecureBPMN [9] are two examples of modeling languages where specific annotations are introduced to extend BPMN with security concepts. However, no approach has been proposed so far to handle with security as a global concern across process-centric and artifact-centric dimensions.…”