Certified Information Flow Analysis of Service Implementations

Abstract

Process analysis enables the certification of distributed business processes using automated process compliance checks. In such an auditing scenario, analysis correctness is key but is usually taken for granted. We therefore argue in this paper for the idea of certified analysis. As is shown by the example of a static information flow analysis and its accompanying Coq development, certified analysis of distributed business processes is feasible and provides machine-checkable correctness certificates and thus helps in increasing thrustworthiness of automated process compliance audits.• We address a heap-based data model for process data as prevalent in state-of-the-art process engines.• We present a formal development for proving the correctness of unified points-to/taint analysis in line with most recent research [4].

Mining BPMN Processes on GitHub for Tool Validation and Development

“…Linting tools, like bpmnlint 4 or BPMNspector [10] can be used to check business process models for suspicious and non-portable modeling styles, mostly on the syntactical level. More elaborate tools allow for checking conformance to best practices, e.g., Signavio 5 , or identifying control and data flow anomalies, e.g., deadlocks [31], processing of undefined data [29], and support even more specific analysis problems like data leak detection [13,16]. Eventually, full-fledged model checking and verification tools can prove the compliance of a process model to certain desirable properties, e.g., proper termination known as soundness [9], by mapping the process model to a formalism like Petri nets [7,14].…”