Managing security objects and -processes using an extended BPM approach and -system

Abstract

One important use case for (business) process technology is process compliance. We propose that managing security objects such as cryptographic keys is an application domain that can greatly benefit from using process technology because of a critical compliance requirement. To this end, we present a BPMN extension and a design of a support system for key management processes. Both were driven by a case study on a distributed application using a standard hierarchical public key infrastructure, which we also present. Our prototypical implementation of the support system shows that process compliance for security object management processes can be substantially supported with moderate effort by extending the standard process technology.