![](bg4.png)
with the best results or all possible solutions and
extra information about value of the parameters. In
this case, we have selected a type of search in order
to obtain all possible solutions since it is more
interesting observe different cases with assignation
of variables and values. In the
Table 1, we show two examples of solutions
found by the resolution of the constraint model using
a constraint solver. One with positive results where
all constraints are satisfied and the other with
negative results where at least one constraint is not
satisfied.
Table 1: Results of the evaluation of constraint model.
CASE 1 CASE 2
Constraints
RC1 = false; RC2 = true
RC3 = true; RC4 = true
RC1 = true; RC2 = true
RC3 = true; RC4 = true
Acceptable Risk
Acceptable Risk = 200 Acceptable Risk = 200
Risk Variables
Risk
store
903
Riskplaceorder=270
Riskreceiveinvoice=240
Riskreceiveproducts=330
Risksettleinvoice=330
Risk_store = (188)[9..196]
Riskplaceorder=270
Riskreceiveinvoice=240
Riskreceiveproducts=330
Risksettleinvoice=330
Treatment Variables
t1_riskreduction = 3 t1_riskreduction=
(21)[79..99]
Cost Variables
Cost=(101)[2100..2200]
Total Cost = 3000
Cost_treatment=(101)
[100..200]
Cost=(101)[2100..2200]
Total Cost = 3000
Cost_treatment=(101)
[100..200]
4 RELATED WORK
There exist different proposals of extensions of business
processes with risk information and non-functional
requirements (Korherr, 2007) (Lambert, 2006), (Jakoubi,
2009), (Menzel, 2009), (Muhelen, 2005), (Cope, 2010).
Most of them only pay attention in the modelling of risk
information or requirements but do not include mechanism
for the automatic evaluation of the risk assessment and the
diagnosis of the conformance of the objectives of the
business process. Moreover these proposals do not
consider the transformation of the requirements to specific
artefacts in the implementation level. Other works
(Menzel, 2009), (Wolter, 2009) consider the introduction
of new elements in order to annotate BPMN diagrams
with parameters which are transformed into a specific
security configuration of a server.
5 CONCLUSIONS
In this work, an overview of the OPBUS architecture
has been presented. OPBUS has been extended with
a MDA approach that provides an extension of
BPMN models with risk information. We propose to
include constraint programming techniques in order
to automate the checking of conformance of the risk
assessment of business processes. For this reason we
have presented a mapping to constraint models.
Once business process are validated the
countermeasures identified in design stage of
business processes can be aligned with specific
control in next layers, for instance with specific fault
tolerance mechanism already included in OPBUS
framework.
ACKNOWLEDGEMENTS
This work has been partially funded by Consejería de
Economía, Innovación y Ciencia of the Regional
Government of Andalusia project under grant P08-TIC-
04095, and by Spanish Ministerio de Ciencia e Innovación
project under grant TIN2009-13714, and by FEDER
(under ERDF Program).
REFERENCES
Cope E. W., Kuster J. M., Etzweiler, D., Deleris , L. A.,
and Ray B., “Incorporating risk into business process
models,” IBM Journal of Research and Development,
vol. 54, no. 3, pp. 4:1 –4:13, 2010.
ENISE, “Integration of Risk Management with Business
processes”. Available at: http://www.enisa.europa.eu/
act/rm/cr/business-process-integration. 2010.
Gartner Inc., “Gartner CIO report,” Available at:
http://www.gartner.com/it/page.jsp?id=1283413, 2010.
Model-Driven Architecture, Available at: http://www.
omg.org/mda/
S. Huang, Y. Chu, Shing-Han Li, D. C. Yen, Enhancing
conflict detecting mechanism for Web Services
composition: A business process flow model
transformation approach, Information and Software
Technology, Vol. 50, pp. 1069-1087, 2008.
Jakoubi, S. and Tjoa, S., “A reference model for risk-
aware business process management,” 4th Internatio-
nal Conference on Risks and Security of Internet and
Systems (CRiSIS), 2009, pp. 82 –89, 2009.
Korherr B. and Beate List, “Extending the EPC and the
BPMN with Business Process Goals and Performance
Measures”, International Conference on Enterprise
Information Systems, 2007.
Lambert, J. H., Jennings, R. K., and Joshi N. N.,
“Integration of risk identification with business
process models,” Syst. Eng., vol. 9, no. 3, pp. 187–
198, 2006.
Menzel, M.; Thomas, I.; Meinel, C., "Security
Requirements Specification in Service-Oriented
Business Process Management," ARES '09, pp.41-48,
16-19 2009.
OPBUS: RISK-AWARE FRAMEWORK FOR THE CONFORMANCE OF SECURITY-QUALITY REQUIREMENTS
IN BUSINESS PROCESSES
373