Semantic Support for Security-Annotated Business Process Models

Business processes are essential components of all enterprises and the use of models, languages and execution engines as components of a Business Process Management (BPM) deployment are now commonplace. By definition, these processes describe an enterprise in terms of its organizational knowledge, structure and activities, and are often essential to realizing an organization's competitive advantage. It thus follows that the design, execution and, critically, responsiveness to change in the system or environment they are affecting, is of prime significance toward establishing and maintaining efficient business operation. Deploying a high quality and effective Business Process Management System (BPMS) is thus utterly essential to many modern enterprises. Yet current trends toward flexible methods of working, just-in-time organizational reaction times, distributed intra-organization and interorganization collaboration and constantly changing markets are creating new and complex business landscapes. This brings about increased complexity, further motivating the need for real-time dynamic change throughout an enterprise's business processes; ever more dynamic environments require key business processes to be more flexible and automated in both their design and behaviour. Yet many companies are now discovering that investments in conventional BPMS often suffers from poor return on investment due to a common inability to create business process models that are both meaningful to business people and capable of offering the real-time process flexibility and rapid process adaptation required to cope effectively with the fluid business conditions typifying many modern enterprises. As evidenced by our work with customers in the manufacturing domain, there is very often a need to alter executing process structures, sometimes in real-time, without perturbing the integrity of running process instances. If a BPMS is not built to innately support change in this manner the result can be reductions in both dependability and visibility, especially from a management perspective. Our observation is that many of the current procedural approaches to BPM are too inflexible and unresponsive to change, especially in any automated fashion. In fact many BPMS solutions provide only design-time modelling, with neither support for run-time determination of process structure, nor direct execution of industry standard Business Process Modeling Notation (BPMN) process models without the need for first translating BPMN into intermediary formats, such as the Business Process Execution Language (BPEL), in preparation for execution. In practice, these issues imply that process models can tend to become overly complex and brittle through the necessity of coding-in all O pe n A cc es s D at ab as e w w w .in te ch w eb .o rg

User preference-based automatic orchestration of web services using a multi-agent

Information System is one of the key domain in which lot of research has been done in the past few years. Applying Information systems to heterogeneous and distributed environments is one of the current research areas. Business Process Management Systems is the information systems which deal with the administration of tasks in the business processes, organizational structures, or in the related context. The Workflow Management system, the early idea of BPM, controls the workflow in an organization, data transfer, and integration of legacy information systems with existing programs and program modules, delegation of business tasks. Offering task management services especially modeling of business processes and underlying organizations, BPM serves it meaning and incorporates the WFM system. BPM supporting the use of knowledge concerning the awareness/unawareness of integrated software, and analysis of processes and organizational structure in terms of verification, modification, evaluation are key management in BPM system I.INTRODUCTION TO BPM: Combination of corporate restructuring and mergers urged the department and processes to be automated and linked together. Unfortunately it created largely disconnected spaghetti of systems and applications. Business Process Management (BPM) was born from a strong need to streamline internal processes and connections between both internal and external functions. It provides ability to model, monitor, manage and manipulate processes quickly in response to changes in strategy and market forces. BPM is an extension of classical Work Flow Management (WFM) systems and approaches. BPM delivers the maximum utility of legacy system. It is a method for revolutionizing the way the work moves throughout an organization. II.COMPONENTS OF BPM: The four key elements in Business Process Management are: Process modeling, Process rule, Process management, and Process performance analytics. Process modeling: Process modeling describes the flow of information (business process).It helps in building a model of process and mapping into an implementation frame work. Modeling requires a consistent analysis and representation of the processes. It forms the basis for the userspecific process environment. Process Rule: Process Rule is a heart of the BPM. It involves execution of discrete steps & integration of information. A process rules engine is used for this purpose. The engine is to monitor and manage the given steps by providing a flow control over the business process. If a process fails or delayed, a compensated action can be done to rectify. Process Management: Process Management is to correlate business/application events to fundamental business metrics .It enables the organization to monitor and optimize the business process. Once the process has been analyzed, modeled and the associated rules are formed. The next stage involves the visualization and management. Visualization means transaction data ranging from holistic to process-state or client state specific rules. Process Performance Analytics: Process Performance Analytics is a transition data source available for sophisticated management analytics .This data should be available on a retrospective or real-time basis. It should answer to one of the most difficult question like “how much does it cost to process a specific transaction?” By this way BPM mainly addresses four components. They are Work Flow Management, Content and records management Enterprise Application Integration (EAI) and Business Activity monitoring (BAM). III.RELEVENCE TO SYSTEM INTEGRATION: BPM can be fitted easily on the top of existing IT system. It is the Process rules that governs all the happenings and optimizes the process. BPM will not be able to work without the connectivity provided by the EAI layer. EAI layer provides BPM to gain and measure the value from the investment. On the other hand, BPM provides value to the EAI technology layer of Information technology. BPM layer offers business management the view of the message processing layer. It is used to unlock the value of the information held in the integration layer. It is also used to gather data of every transaction in the lifecycle. IV.APPLICATION OF BPM: BPM can be applied to any application which needs these advantages. BPM reduces unnecessary high losses in time critical transactions, helps to provide any critical information, practical application yield fast ROI ,better control over the information, identifying and maximizing the benefits faster, better analysis and tracking, provides enterprise-wide visibility of business processes, improve the effectiveness of the core operations, provides ability to coordinate interactions between information systems, business process and the people, flexible and easily changed by non-technical business people.

In order to increase IT and business agility or to improve IT systems and business processes integration many organizations are currently implementing business process management systems (BPMS) or adopting a service-oriented architecture (SOA) paradigm. However, in doing so, IT complexity will admittedly increase and IT managers then are in need of effective governance techniques covering both strategic initiatives, BPM and SOA. This contribution re-examines the problem domain in the novel Enhanced Process-Driven Architecture (ePDA) model in order to systematically derive the requirements for combined BPM and SOA governance. We then formulate a semantic meta model capable of capturing necessary artifacts and describe its technical implementation in Software AG’s and Fujitsu’s joint CentraSite governance re gis try/repository. As "lessons learned" from several projects we systematically derive governance benefits using the Analytic Hierarchy Process (AHP) and highlight measures on software deployment issues.KeywordsSOA GovernanceBPM GovernanceBusiness Process Manage-mentIT GovernanceAnalytic Hierarchy Process (AHP)

The Business Process Model and Notation (BPMN) has become the de facto standard for process modeling. Currently, BPMN models can be (a) analyzed or simulated using specialized tools, (b) executed using business process management systems (BPMSs), or (c) used for requirements elicitation. Although there are many studies comparing BPMN to other modeling techniques for analyzing and executing processes, there are few showing the suitability of BPMN models as a source for requirements comprehension in projects where process-aware software is built without using BPMSs. This chapter presents a study aimed at comparing the comprehension of software requirements regarding a business process using either BPMN or traditional techniques, such as use cases. In our study, we analyzed responses of 120 undergraduate and graduate students regarding the requirements comprehension achieved when using only BPMN models, only use cases, or both. The results do not show significant impact of the artifacts on the comprehension level. However, when the understanding of the requirement involves sequence of activities, using the BPMN shows better results on the comprehension time.

Business Process Management Systems (BPMS) provide automated support for the execution of business processes in modern organisations. With the advent of cloud computing, the deployment of BPMS is shifting from traditional on-premise models to the Software-as-a-Service (SaaS) paradigm with the aim of delivering Business Process Automation as a Service on the cloud. To cope with the impact of numerous simultaneous requests from multiple tenants, a typical SaaS approach will launch multiple instances of its core applications and distribute workload to these application instances via load balancing strategies that operate under the assumption that tenant requests are stateless. However, since business process executions are stateful and often long-running, strategies that assume statelessness are inadequate for ensuring a uniform distribution of system load. In this paper, we propose several new load balancing strategies that support the deployment of BPMS in the cloud by taking into account (a) the workload imposed by the execution of stateful process instances from multiple tenants and (b) the capacity and availability of BPMS workflow engines at runtime. We have developed a prototypical implementation built upon an open-source BPMS and used it to evaluate the performance of the proposed load balancing strategies within the context of diverse load scenarios with models of varying complexity.

Service Oriented Architecture (SOA) has been widely used during the past decade due to its ability to seamlessly integrate various applications developed using different technologies. Web services based on open standards are the most commonly used technology to realize an SOA. Business processes are executed by appropriate orchestration of various services from different departments that belong to a single organization or from multiple organizations. Security is an important quality attribute that has to be built into any application that is developed using SOA. XML is the underlying technology for Web Service Description Language (WSDL), SOAP protocol and Business Process Execution Language (BPEL). It is highly probable that an attacker could inject malicious information into these XML files to modify the flow of the business process. Further, SOAP was not designed with security in mind, it is possible to tamper the SOAP messages while they are in transit. There exist a number of such potential vulnerabilities which lead to possible security breach in the individual services. In an orchestrated business process, there are possibilities of more vulnerabilities. One of the existing tools namely WS-Attacker is only capable of testing the security of individual web services alone. In spite of the widespread usage of SOA, currently there is limited automatic tool support for testing the security provided by an entire SOA application involving service orchestration. In this context, this paper focuses on designing and implementing a plug-in for WS-Attacker to analyze a few security vulnerabilities present in SOA business processes.

In previous chapters, we have discussed the use of the multilevel business artifact (MBA) for multilevel business process modeling in order to better represent the interactions between the different hierarchy levels within a company. As the preparation for a proof-of-concept implementation, in Chapter 6, we have introduced an XML-based logical representation for MBAs. Relying on this XML representation, in this chapter, we present the implementation concept for a business process management system that enables the MBA-based (semi-)automated execution of multilevel business processes. A business process management system manages process-related data and allows for the event-driven execution of business processes; a business process management system also records event data. The recording of event data in event logs is a pre-requisite for business process intelligence which allows for performance analysis and the subsequent improvement of business processes based on the analysis results.

Semantic Web services is considered as the concept bringing the web to its full potential by combining the best features of web services, agent technology, grid and the Semantic web. In this paper we present a semantic Web Services platform based on software agent (JASW), which introduces Semantic web and software agent and takes the automated discovery, selection, orchestration and invocation of Web services as application background. In the platform, we adopt Semantic web to accurately describe Web services, and use software agent to implement discovery, selection, and orchestration of Web services.

Although information and Internet technology developed rapidly, how to realize flexible integration of enterprise application, and how to realize coordination of the heterogeneous information system and automation of the business process, have been core issues that need to be further researched. Application of Web Services and WS-BPEL can solve this problem. By using Web Services, which is platform-independent and loosely coupled, business process can be adapted to rapidly changing environment. On the other hand, BPM combination of services for process planning and management can further improve business efficiency and lower development cost. In this paper, based on the web services and WS-BPEL, utilizing a typical commercial model, the web services of business process are developed, and the method of using WS-BPEL for process planning is explored. At the same time, web services orchestration is fulfilled through the WS-BPEL, commercial model of process automation instance is established. In the end, business process automation is implemented and tested accordingly.

Web services – a new breed of self-contained, self-describing, modular applications published, located, and invoked across the Web – handle functions, from simple requests to complicated business processes. They are defined as network-based application components with a services-oriented architecture (SOA) using standard interface description languages and uniform communication protocols. SOA enables organizations to grasp and respond to changing trends and to adapt their business processes rapidly without major changes to the IT infrastructure. The Inaugural International Conference on Next-Generation Web Services Practices (NWeSP'05) attracted researchers who are also the world's most respected authorities on the semantic Web, Web-based services, and Web applications and services. NWeSP'05 was held in cooperation with the IEEE Computer Society Task Force on Electronic Commerce, the Technical Committee on Internet, and the Technical Committee on Scalable Computing. This special issue presents eight papers focused on different aspects of Web services and their applications. Papers were selected based on fundamental ideas and concepts rather than the thoroughness of techniques employed. Papers are organized as follows: <I>Taher et al.</I> present the first paper, on a Quality of Service Information and Computational framework (QoS-IC) supporting QoS-based service selection for SOA. The framework's functionality is expanded using a QoS constraints model that establishes an association relationship between different QoS properties and is used to govern QoS-based service selection in the underlying algorithm. Using a prototype implementation, the authors demonstrate how QoS constraints improve QoS-based service selection and save consumers valuable time. Due to the complex infrastructure of web applications, response times perceived by clients may be significantly longer than desired. To overcome some of the current problems, <I>Vilas et al.</I>, in the second paper, propose a cache-based extension of the architecture that enhances the current web services architecture, which is mainly based on program-logic or protocol-dependent optimization. In the third paper, Jo and Yoo present authorization for securing XML sources on the Web. One of the disadvantages of existing access control is that the DOM tree must be loaded into memory while all XML documents are parsed to generate the DOM tree, such that a lot of memory is used in repetitive search for tree to authorize access to all nodes in the DOM tree. The complex authorization evaluation process required thus lowers system performance. Existing access control fails to consider information structure and semantics sufficiently due to basic HTML limitations. The authors overcome some of these limitations in the proposed model. In the fourth paper, Jung and Cho propose a novel behavior-network-based method for Web service composition. The behavior network selects services automatically through internal and external links with environmental information from sensors and goals. An optimal service is selected at each step, resulting in a globally optimal service sequence for achieving preset goals. The authors detail experimental results for the proposed model by comparing them with rule-based system and user tests. <I>Kong et al.</I> present an efficient method in the fifth paper for merging heterogeneous ontologies – no ontology building standard currently exists – and the many ontology-building tools available are based on different ontology languages, mostly focusing on how to create, edit and infer the ontology efficiently. Even ontologies about the same domain differ because ontology experts hold different view points. For these reasons, interoperability between ontologies is very low. The authors propose merging heterogeneous domain ontologies by overcoming some of the above limitations. In the sixth paper, Chen and Che provide polynomial-time tree pattern query minimization algorithm whose efficiency stems from two key observations: (i) Inherent redundant "components" usually exist inside the rudimentary query provided by the user, and (ii) nonedundant nodes may become redundant when constraints such as co-occurrence and required child/descendant are given. They show that the algorithm obtained by first augmenting the input tree pattern using constraints, then applying minimization, invariably finds a unique minimal equivalent to the original query. Chen and Che present a polynomial-time algorithm for tree pattern query (TPQ) minimization without XML constraints in the seventh paper. The two-part algorithm is a dynamic programming strategy for finding all matching subtrees within a TPQ. The algorithm consists of one for subtree recognization and a second for subtree deletion. In the last paper, <I>Bagchi et al.</I> present the mobile distributed virtual memory (MDVM) concept and architecture for cellular networks containing server-groups (SG). They detail a two-round randomized distributed algorithm to elect a unique leader and co-leader of the SG that is free of any assumption about network topology, and buffer space limitations and is based on dynamically elected coordinators eliminating single points of failure. As guest editors, we thank all authors featured in this special issue for their contributions and the referees for critically evaluating the papers within the short time allotted. We sincerely believe that readers will share our enjoyment of this special issue and find the information it presents both timely and useful.

Business Process Management (BPM) brings together the idea of effectively managing organizations and properly using Information Technology to fulfill organizations’ needs. For this purpose, BPM systems are largely used nowadays. However, most process models are started from scratch, not having reuse promoted. Sometimes, large enterprises have the same business process implemented in a variety of ways due to differences in their departmental cultures or environments, even when using a unique integrated system. Additionally, although technology plays an important role in actually improving organizations, the human factor is still fundamental, since any improvement attempt goes through cultural changes. In this chapter, a peer-to-peer (P2P) tool is proposed as a way to cooperatively develop business processes models, minimizing the time needed to develop such models, reducing the differences among similar processes conducted in distinct organizational units, enhancing the quality of models, promoting reuse, and distributing knowledge.

Business process modeling languages, such as BPMN, offer an abstract view to Web service composition, where business functionalities are decomposed into activities connected through high level control and possibly data flows. Closing the gap between abstract modeling and concrete business process execution requires to solve data mismatches between producer and consumer services with specific adapters. Automatically generating data adapters as well as selecting actual services such as to minimize mismatches are major barriers to this end. In this paper, we present some new pieces of framework providing an end-to-end solution to this problem, (1) first by evaluating the level of data mismatches between candidate producer and consumer services in a business process, (2) second by selecting services in such a way to globally minimize the overall data mismatches in a process, and (3) finally by generating transformations from output to input XML data everywhere needed in the data flow. Moreover, we extend this framework to cope with the failure of selected services at run-time by choosing a replacement service that locally minimizes the data mismatches with its providers and clients in the process. Our solution is implemented and performance evaluations show its feasibility since the cost of selecting a replacement service is typically less than the one of one call to a remote Web service.

The current approach to the design, maintenance, and governance of service-oriented architecture (SOA) solutions has focused primarily on flow-driven assembly and orchestration of reusable service components. The practical application of this approach in creating industry solutions has been limited, because flow-driven assembly and orchestration models are too rigid and static to accommodate complex, real-world business processes. Furthermore, the approach assumes a rich, easily configured library of reusable service components when in fact the development, maintenance, and governance of these libraries is difficult. An alternative approach pioneered by the IBM Research Division, model-driven business transformation (MDBT), uses a model-driven software synthesis technology to automatically generate production-quality business service components from high-level business process models. In this paper, we present the business entity life cycle analysis (BELA) technique for MDBT-based SOA solution realization and its integration into service-oriented modeling and architecture (SOMA), the end-to-end method from IBM for SOA application and solution development. BELA shifts the process-modeling paradigm from one that is centered on activities to one that is centered on entities. BELA teams process subject-matter experts with IT and data architects to identify and specify business entities and decompose business processes. Supporting synthesis tools then automatically generate the interacting business entity service components and their associated data stores and service interface definitions. We use a large-scale project as an example demonstrating the benefits of this innovation, which include an estimated 40 percent project cost reduction and an estimated 20 percent reduction in cycle time when compared with conventional SOA approaches.

Service Oriented Architecture (SOA) introduced the web services as distributed computing components that can be independently deployed and invoked by other services or software to execute composite services that represent an end-to-end business process. An important problem in the SOA is the web service selection and composition problem which involves selecting the right web services mix to construct the best service composition that achieves the consumers Service Level Agreement (SLA) requirements. In this chapter we propose different methods to solve the problem of the business processes execution engine web service selection and services composition construction in the Service Oriented Architecture (SOA).  The chapter provides different mechanisms to improve the web services selection and composition using dynamic techniques. The main goal is to satisfy the services' requirements expressed as the SLA and to enhance the services selection and composition by increasing the availability and decreasing the response time of the service compositions.