The goal of this thesis is to design and implement a security and compliance monitoring and enforcement mechanism for processes defined in Business Process Modeling Notation (BPMN). At first, a domain specific policy language is adopted to augment the BPMN specification with security and compliance requirements. Later on, these requirements are transformed to a set of policies and stored in a Policy Decision Point(PDP). Finally, a Process Enforcement Point(PEP)is developed (or adopted) to enforce respective policies at runtime.
The second goal of this thesis is to perform a case-study on areal-world software solution offered by Brainloop3, which has agreed to be the industrial partner for this thesis topic. This case-study will include a)integration of the policy enforcement mechanism,b)security evaluation of the implemented mechanism and c)performance evaluation of the mechanism.