David Schumm

Business Compliance Governance in Service-Oriented Architectures

Governing business compliance with regulations, laws, best practices, contracts, and the like is not an easy task, and so far there are only limited software products available that help a company to express compliance rules and to analyze its compliance state. We argue that today’s SOA-based way of implementing and conducting business (e.g., using Web services and business process engines) lends itself very well to the development of a comprehensive compliance government solution that effectively aids companies in being compliant. In this paper, we contextualize the compliance problem in SOA-based businesses, we highlight which are the most salient research challenges that need to be addressed, and we describe our approach to compliance governance, spanning design, execution, and evaluation concerns.

Compliant Cloud Computing (C3): Architecture and Language Support for User-Driven Compliance Management in Clouds

Cloud computing represents a promising computing paradigm, where computational power is provided similar to utilities like water, electricity or gas. While most of the Cloud providers can guarantee some measurable non-functional performance metrics e.g., service availability or throughput, there is lack of adequate mechanisms for guaranteeing certifiable and auditable security, trust, and privacy of the applications and the data they process. This lack represents an obstacle for moving most business relevant applications into the Cloud. In this paper we devise a novel approach for compliance management in Clouds, which we termed Compliant Cloud Computing (C3). On one hand, we propose novel languages for specifying compliance requirements concerning security, privacy, and trust by leveraging domain specific languages and compliance level agreements. On the other hand, we propose the C3 middleware responsible for the deployment of certifiable and auditable applications, for provider selection in compliance with the user requirements, and for enactment and enforcement of compliance level agreements. We underpin our approach with a use case discussing various techniques necessary for achieving security, privacy, and trust in Clouds as for example data fragmentation among different protection domains or among different geographical regions.

Vino4TOSCA: A Visual Notation for Application Topologies Based on TOSCA

A major difficulty in enterprise computing is the modeling of complex application topologies consisting of numerous individual components and their relationships. Especially in the context of cloud computing, the Topology and Orchestration Specification for Cloud Applications (TOSCA) has been proposed recently for standardization to tackle this issue. However, TOSCA currently lacks a well-defined visual notation enabling effective and efficient communication in order to transport the semantics of the encoded information to human beings. In this paper, we propose a visual notation for TOSCA based on established usability research which provides additional concepts for visual modularization and abstraction of large application topologies.

CMotion: A framework for migration of applications into and between clouds

The number of applications and services hosted in the cloud grows steadily, because of significant advantages in cost, flexibility, and scale compared to traditional IT. However, major difficulties in this field are (i) the migration of existing applications into the cloud and (ii) the increasing vendor lock-in which denotes the inability to leave a certain cloud provider without significant effort. Current approaches do not offer a holistic solution: Either they require the user to provide the application in a certain standardized way or they are only able to migrate one specific type of component. As a consequence, the migration of composite applications with different types of components is not supported. To overcome this limitation we propose the Cloud Motion Framework (CMotion) which leverages existing application models and provides support to migrate composite applications into and between clouds. Based on the application model, the framework evaluates alternative ways to host each component. CMotion assumes that the dependencies of components are modeled explicitly and the components are self-contained.

Towards Reference Passing in Web Service and Workflow-Based Applications

In a Service-Oriented Architecture (SOA) based on Web Service technology the services typically communicate with each other by passing data values directly from one service to another. In the case the services are orchestrated by workflows the services receive their input values from the workflow engine and return their calculated results back to the engine by value. In this paper we show several use cases where such value passing behavior has drawbacks. To address this challenge we introduce the concept of pointers in SOA. Pointers allow services to pass their data by reference which is a fundamental advantage for Web Service communication. Furthermore we show an extension of BPEL that introduces reference variables as new type of data containers in workflows. In addition, for the management of pointers we present the Reference Resolution System which can be used in very flexible setups either as central or distributed system.

An architectural pattern language of cloud-based applications

The properties of clouds -- elasticity, pay-per-use, and standardization of the runtime infrastructure -- enable cloud providers and users alike to benefit from economies of scale, faster provisioning times, and reduced runtime costs. However, to achieve these benefits, application architects and developers have to respect the characteristics of the cloud environment. To reduce the complexity of cloud application architectures, we propose a pattern-based approach for cloud application design and development. We defined a pattern format to describe the principles of cloud computing, available cloud offerings, and cloud application architectures. Based on this format we developed an architectural pattern language of cloud-based applications: through interrelation of patterns for cloud offering descriptions and cloud application architectures, developers are guided during the identification of cloud environments and architecture patterns applicable to their problems. We cover the proceeding how we identified patterns in various information sources and existing productively used applications, give an overview of previously discovered patterns, and introduce one new pattern. Further, we propose a framework for the organizations of patterns and the guidance of developers during pattern instantiation.

Process Viewing Patterns

Business processes represent a fundamental asset of a company as they describe the core knowledge underlying its competitive advantage. Tools for modeling and analysis of business processes have to cope with the increasing complexity of these processes. A view on a process intends to abstract from details and make complex processes easier to understand. A process view results from specific transformations applied to a process model. In this paper we introduce a metamodel for process views as well as process viewing patterns which specify elementary transformations to alter an existing process. The patterns are presented in a technology independent manner and can be applied to any process language that can be represented by a process graph.

Pattern-Based Development and Management of Cloud Applications

Cloud-based applications require a high degree of automation regarding their IT resource management, for example, to handle scalability or resource failures. This automation is enabled by cloud providers offering management interfaces accessed by applications without human interaction. The properties of clouds, especially pay-per-use billing and low availability of individual resources, demand such a timely system management. We call the automated steps to perform one of these management tasks a “management flow”. Because the emerging behavior of the overall system is comprised of many such management flows and is often hard to predict, we propose defining abstract management flows, describing common steps handling the management tasks. These abstract management flows may then be refined for each individual use case. We cover abstract management flows describing how to make an application elastic, resilient regarding IT resource failure, and how to move application components between different runtime environments. The requirements of these management flows for handled applications are expressed using architectural patterns that have to be implemented by the applications. These dependencies result in abstract management flows being interrelated with architectural patterns in a uniform pattern catalog. We propose a method by use of a catalog to guide application managers during the refinement of abstract management flows at the design stage of an application. Following this method, runtime-specific management functionality and management interfaces are used to obtain automated management flows for a developed application.

Fragmento: Advanced Process Fragment Library

Reuse is a common discipline for decreasing software development time and for improving overall quality, independent from the domain. As business processes represent a fundamental asset of an organization, several concepts for enabling reuse during process modeling have been proposed. However, only few concrete examples for reusable process artifacts have been discussed so far. In this paper, we present the concept of process fragments and an example collection of process fragments for illustrating our reuse concept and for showing that it can actually be applied in practice for an easier and faster development of process-based applications. The fragment examples demonstrate different characteristics such fragments may exhibit. We also argue that this work will encourage reuse of process logic in terms of fragments, since it also provides an opportunity to design and develop a process fragment library for collecting process logic explicitly. As technical enabler for the approach we present a prototype called Fragmento.

On Visualizing and Modelling BPEL with BPMN

The advantages of the process-based approach toimplementing applications lead to the development ofnotations for modelling business processes andlanguages for enacting them in a process engine forthe purpose of process automation. Currently theBusiness Process Modeling Notation (BPMN) istypically used for modelling business processes andthe Business Process Execution Language (BPEL) isused as the process execution format. Both languagesdiffer in purpose, expressivity and operationalsemantics. Recently it has been shown that there is nocomplete bi-directional mapping between BPMN andBPEL and transformations have been defined betweenthe two formalisms. However, these transformationslead to more complex models in both, BPEL andBPMN, and enable a roundtrip for only a limitednumber of scenarios. In this paper we show how BPELprocesses can be modelled using the graphical aspectof BPMN in order to facilitate modelling of executableprocesses using BPMN while avoiding modeltransformations.