Runtime Verification of Business Processes and Information Security Management
"Learn about the importance of runtime verification in business processes, information security management defined by the C-I-A triad, and quality assurance practices. Explore the main objectives and related implementations of VPP-2 at the University of Latvia in 2016. Find out how processes, security, and quality are ensured in a dynamic environment."
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Runtime Verification of Business Processes J nis Bi evskis, University of Latvia VPP-2.posms, 2016, Riga
Security Information security is defined within the standard in the context of the C-I-A triad: the preservation of confidentiality (ensuring that information is accessible only to those authorized to have access), integrity (safeguarding the accuracy and completeness of information and processing methods) availability (ensuring that authorized users have access to information and associated assets when required). ISO/IEC 27002 provides best practice recommendations on information security management.
Processes define activity systems staff proceses VPP-2.posms, 2016, Riga
Initial question Does business process runs correctly? Process can run over more than one IS Environment is changing May be process instance is late? Some processes only partly are supported by IS VPP-2.posms, 2016, Riga
Quality assurance Static analysis software is verified without execution Dynamic analysis software verification using test examples in the testing environment Runtime verification software is verified continuously during runtime in the live environment VPP-2.posms, 2016, Riga
Main objectives Provide verification for processes without built-in verification mechanism Provide verification for processes running in heterogeneous environment Provide early warning and error messaging system Provide easy and dynamic definition of process verification descriptions VPP-2.posms, 2016, Riga
Related implementations Hardware and software monitoring Widely used in embedded systems: automotive industrial machinery Document management and workflow systems monitoring SOA proxy verifies request, responses, execution patterns and timing VPP-2.posms, 2016, Riga
Problems Built-in solutions Implemented for one system or one platform SOA proxy only for webservices and intervening with execution VPP-2.posms, 2016, Riga
Correctness criteria Process is executed by legal execution path Required actions are executed Execution time limits are not violated VPP-2.posms, 2016, Riga
Proposed solution Verification process is designed for each base process Controller verifies process execution using process verification description Process execution events are detected by agents VPP-2.posms, 2016, Riga
Base process -> verification process VPP-2.posms, 2016, Riga
Proposed solution Verification process is designed for each base process Controller verifies process execution using process verification description Process execution events are detected by agents VPP-2.posms, 2016, Riga
Verification mechanism controller <-> agents VPP-2.posms, 2016, Riga
Process verification description language Base element event describing activity: type parameters agent & address timing (fixed time or relative) Event order Events may have subevents Variables are used to link events VPP-2.posms, 2016, Riga
Lessons learned by prototyping Rather detailed base process execution model must be available Agent delays and some peculiarities should be taken into account Agents must be developed with minimum overhead for runtime environment: event-based recomended VPP-2.posms, 2016, Riga
Performance issues Agents identified all of requested evetns Errors were caused by the controller workload event request reached agent after event occured Event detection could be requested more than one step ahead 70% Missed/false negative events 60% 50% 40% False negative 30% 20% Missed events 10% 0% 150 175 200 Instances (150 40events/s, 400 60 evetns/s) 225 250 275 300 325 350 375 400 VPP-2.posms, 2016, Riga
Summary Solution is applicable for heterogeneous environment No changes are required in running systems Set of agents may be supplements without any changes in controller or verification process descriptions Solution is applicable for wide area of problems: high level business processes document processing systems time critical data processing systems VPP-2.posms, 2016, Riga
Thank you for attention! Questions? VPP-2.posms, 2016, Riga
