Verifying compliance in process choreographies: Foundations, algorithms, and implementation. Issue 108 (September 2022)

• Record Type: Journal Article
• Authors: Fdhila, Walid; Knuplesch, David; Rinderle-Ma, Stefanie; Reichert, Manfred
• Is Part Of: Information systems. Issue 108(2022)
• Publication Date: 2022-09
• Subjects: Distributed business processes -- Business rules -- Compliance management -- Process choreography -- Business process compliance -- Global compliance rules -- Rule decomposition; Database management -- Periodicals; Electronic data processing -- Periodicals; Bases de données -- Gestion -- Périodiques; Informatique -- Périodiques; Database management; Electronic data processing; Periodicals; 005.7
• DOI: 10.1016/j.is.2022.101983
• Languages: English
• ISSNs: 0306-4379

Abstract

Abstract: The current push towards interoperability drives companies to collaborate through process choreographies. At the same time, they face a jungle of continuously changing regulations, e.g., due to the pandemic and developments such as the BREXIT, which strongly affect cross-organizational collaborations. Think of, for example, supply chains spanning several countries with different and maybe even conflicting COVID19 traveling restrictions. Hence, providing automatic compliance verification in process choreographies is crucial for any cross-organizational business process. A particular challenge concerns the restricted visibility of the partner processes at the presence of global compliance rules (GCR), i.e., rules that span across the process of several partners. This work deals with the question how to verify global compliance if affected tasks are not fully visible. Our idea is to decompose GCRs into so called assertions that can be checked by each affected partner whereby the decomposition is both correct and lossless. The algorithm exploits transitivity properties of the underlying rule specification, and its correctness and complexity are proven, considering advanced aspects such as loops. The algorithm is implemented in a proof-of-concept prototype, including a model checker for verifying compliance. The applicability of the approach is further demonstrated on a real-world manufacturing use case. Highlights: Decomposition enables decentralized checking of global compliance rules. Global compliance decomposition avoids trust in a central coordinator with knowledge on private tasks. Global compliance decomposition improves privacy of partner private processes. Global Compliance decomposition reduces compliance-related partner communication. Proof-of-concept and practical applications.