Static enforcement of process-level security and compliance specifications for cloud-based systems

A non-transitory computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations for statically checking conformance of a computer-implemented service at a source code level to requirements specified at a process level, the operations comprising:

• receiving source code of the computer-implemented service comprising a service name identifying a process that is associated to the computer-implemented service;
• generating a request indicating a process model generated using secure business process modeling and the request comprising the service name;
• receiving in response to the request, from a model repository, the process model;
• extracting, from the model repository, requirements of the process model that the computer-implemented service is to comply with, the requirements comprising an access control defining an authorization based on each of a plurality of user roles to perform tasks, a separation of duty restricting a first task based on one of the plurality of user roles, and a binding of duty requiring the completion of a second task based on one or more of the plurality of user roles;
• extracting one or more interfaces based on the process model;
• generating a mapping of process level security and compliance specifications to implementation level security and compliance specifications, the mapping associating the requirements with the source code based on the one or more interfaces;
• providing one or more rules comprising a set of technical requirements that can be checked on the source code level, the one or more rules being provided based on the requirements and the mapping;
• and
• processing the source code and the one or more rules using static code analysis (SCA) to generate a result, the result indicating whether the computer-implemented service conforms to the requirements.

A system for sharing data in a supply chain, the data corresponding to an item having a tag associated therewith, the system comprising:

• one or more computers;
• and
• a computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations for statically checking conformance of a computer-implemented service at a source code level to requirements specified at a process level, the operations comprising:
• receiving source code of the computer-implemented service, the source code comprising a service name identifying a process that is associated to the computer-implemented service;
• generating a request indicating a process model generated using secure business process modeling and the request comprising the service name;
• receiving in response to the request from a model repository, the process model;
• extracting, from the model repository, requirements of the process model that the computer-implemented service is to comply with, the requirements comprising an access control defining an authorization based on each of a plurality of user roles to perform tasks, a separation of duty restricting a first task based on one of the plurality of user roles, and a binding of duty requiring the completion of a second task based on one or more of the plurality of user roles;
• extracting one or more interfaces based on the process model;
• generating a mapping of process level security and compliance specifications to implementation level security and compliance specifications, the mapping associating the requirements with the source code based on the one or more interfaces;
• providing one or more rules comprising a set of technical requirements that can be checked on the source code level, the one or more rules being provided based on the requirements and the mapping;
• and
• processing the source code and the one or more rules using static code analysis (SCA) to generate a result, the result indicating whether the computer-implemented service conforms to the requirements.