Nikolaos Argyropoulos
email: n.argyropoulos@brighton.ac.uk

Luis Márquez Alcañiz

Haralambos Mouratidis
email: h.mouratidis@brighton.ac.uk

Andrew Fish
email: andrew.fish@brighton.ac.uk

David G Rosado
email: david.grosado@uclm.es

Ignacio García-Rodriguez De Guzmán

Eduardo Fernández-Medina
email: eduardo.fdezmedina@uclm.es

Eliciting Security Requirements for Business Processes of Legacy Systems

Keywords: Legacy systems, Business Process Modelling, Goal-oriented Security Requirements, Secure Tropos, BPMN, MARBLE

The modernisation of enterprise legacy systems, without compromises in their functionality, is a demanding and time consuming endeavour. To retain the underlying business behaviour during their modernisation, the MARBLE TM framework has been developed for the extraction of business process models from their source code. Building on top of that work, in this paper we propose an integrated approach for transforming the extracted legacy process models into Secure Tropos goal models. Such models facilitate the elicitation of security requirements in a high level of abstraction, which are then incorporated back into the process models of the modernised systems as security features. Therefore high level models can be derived from legacy source code with minimal manual intervention, where security can be elaborated by nontechnical stakeholders in alignment with organisational objectives.

Introduction

The essence of legacy system migration is to move an existing, operational system to a new environment, retaining the functionality of the legacy system while causing as little disruption to the existing operational and business environment as possible [START_REF] Wu | Legacy System Migration: A Legacy Data Migration Engine[END_REF]. Legacy system migration is a very expensive procedure which carries a definite risk of failure. Consequently before any decision to migrate is taken, an intensive study should be undertaken to quantify the risk and benefits and fully justify the redevelopment of the legacy system involved [START_REF] Bisbal | Legacy information systems: issues and directions[END_REF][START_REF] Bisbal | A Survey of Research into Legacy System Migration[END_REF].

Reverse engineering techniques have become very important within the legacy system migration process, providing several benefits. Firstly, reverse engineering allows the retrieval of abstract representations to facilitate the comprehension of different legacy systems, such as relational databases [START_REF] Cleve | Dynamic analysis of SQL statements for data-intensive applications reverse engineering[END_REF] and aspect oriented systems [START_REF] Bernardi | Reverse Engineering of Aspect Oriented Systems to Support their Comprehension, Evolution, Testing and Assessment[END_REF]. Secondly, abstract representations obtained by reverse engineering from legacy systems can be refactored to improve their maintainability or add new functionalities to evolve legacy systems. To meet these demands, business process archaeology has emerged as a set of techniques and tools to recover business processes from source code [START_REF] Pérez-Castillo | Business process archeology using MARBLE[END_REF]. One of the main benefits of business process archaeology is that it preserves business behaviour buried in legacy source code and it retrieves business processes, thereby providing more opportunities for refactoring due to the higher abstraction level.

During business process refactoring new security features can also be introduced to evolve the legacy business processes. Since the advantages of the early identification of security requirements are recognised by the consensus of the RE literature [START_REF] Liu | Security and privacy requirements analysis within a social setting[END_REF][START_REF] Mellado | A common criteria based security requirements engineering process for the development of secure information systems[END_REF], it is imperative that security concerns are taken into account during the early redesign stages of such systems. An advantage of eliciting security requirements in the early (re-)development stages is the lower possibility of security issues arising when the system is already in use, which would require redesigns and significant downtimes, thus proving costly for enterprises [START_REF] Whitman | Enemy at the gate: Threats to Information Security[END_REF].

The security objectives of an enterprise are expressed via security requirements, which are used as input during the redesign of the business processes supported by such legacy systems. The development of "secure by design" business processes is considered highly beneficial as information security breaches can impact enterprises both financially and in terms of reputation and trust from the customer's side. It can also be a legal obligation to regulate and ensure the security of sensitive information handled by business processes [START_REF] Leitner | A systematic review on security in Process-Aware Information Systems -Constitution, challenges, and future directions[END_REF]. However, despite its apparent importance and the potential to greatly benefit modern business processes, security is usually considered as an afterthought during their development in practice [START_REF] Neubauer | Secure Business Process Management: A Roadmap[END_REF] and receives little attention from business process management (BPM) approaches developed in research [START_REF] Pavlovski | Non-Functional Requirements in Business Process Modeling[END_REF][START_REF] Rodríguez | Secure business process model specification through a UML 2.0 activity diagram profile[END_REF].

In this work we present a novel approach for the modernisation of legacy systems from an information security point of view. It facilitates the elaboration of security requirements via Secure Tropos goal models, derived from legacy business processes which are automatically extracted from their legacy source code. Therefore, by integrating existing and novel components, the proposed approach facilitates a unique transformation of the lowest abstraction level of legacy systems (i.e., source code) to highly abstract enterprise models in a largely automated manner. As a result it offers to non-technical enterprise stakeholders a platform appropriate for capturing high-level organisational security objectives in the form of security requirements, which can then be integrated back to the business processes as security features.

The rest of the paper is structured as follows; Section 2 presents related work in the areas of process archaeology and goal-to-process model transformations. Section 3 introduces our approach and its four building blocks: i) the MARBLE TM framework for the derivation of a process models from legacy source code, ii) the IBUPROFEN algorithms for the refactoring of the extracted process model, iii) the Secure Tropos approach for security-oriented goal modelling and iv) the transformation algorithms for the transition from process to goal models and vice versa. In Section 4 our approach is applied to a module extracted from a real software application, while final conclusions are provided in Section 5.

Related Work

Process Archaeology

Business process archaeology [START_REF] Pérez-Castillo | Business process archeology using MARBLE[END_REF] studies the business processes in an organization by analysing the existing software artefacts. The objective is to discover the business forces that motivated the construction of the enterprise information systems. On the one hand, traditional archaeologists investigate several artefacts and situations, trying to understand what they are looking at, i.e., they must understand the cultural and civilizing forces that produced those artefacts. Similarly, a business process archaeologist analyses different legacy artefacts such as source code, databases and user interfaces and then tries to learn what the organization was thinking while also attempting to understand why the organization developed the information system in a particular way. The business process archaeology initiative is being progressively supported by new reverse engineering techniques and tools to retrieve and elicit the embedded business knowledge. One of these tools is MARBLE TM [START_REF] Pérez-Castillo | MARBLE: Modernization approach for recovering business processes from legacy information systems[END_REF][START_REF] Pérez-Castillo | MAR-BLE. A business process archeology tool[END_REF], a business process archaeology method to rebuild business processes embedded in legacy information systems.

Aligning Business Processes with Organisational Goals

The organisational context of the enterprise enacting a business process, provides valuable input for its successful (re-)design. Since graphical process modelling standards are not fully equipped to encapsulate such context, goal-oriented modelling languages are better suited for that purpose [START_REF] Ko | Business process management (BPM) standards: a survey[END_REF] since they can capture the intentions of stakeholders as system requirements [START_REF] Lapounchnian | Requirements-driven design and configuration management of business processes[END_REF]. Nevertheless, while goal models can provide a high-level direction and rationale in the form of goals, they lack the ability to adequately identify the specifics of their implementation at the process level. Thus goal-oriented requirements engineering (GORE) should be used more as a starting point, rather than a complete solution for the further development of process designs [START_REF] Horkoff | Taking Goal Models Downstream: A Systematic Roadmap[END_REF].

To that end, a number of approaches have been developed starting from goal models and eliciting business process designs. Mappings between organisational goals and process activities are introduced by such approaches in order to facilitate the transition between goal and process models. A variety of GORE frameworks have been utilised, such as KAOS in [START_REF] Koliadis | Relating Business Process Models to Goal-Oriented Requirements Models in KAOS[END_REF] and [START_REF] Ghose | Goal-driven business process derivation[END_REF], Tropos in [START_REF] Pistore | Requirements-driven verification of Web services[END_REF] and [START_REF] Guizzardi | Bridging the Gap between Goals, Agents and Business Processes[END_REF] and i* in [START_REF] Lo | From Business Models to Service-Oriented Design: A Reference Catalog Approach[END_REF][START_REF] Decreus | A Goal-Oriented Requirements Engineering Method for Business Processes[END_REF] and [START_REF] Ruiz | GoBIS: An integrated framework to analyse the goal and business process perspectives in information systems[END_REF]. Such generic model transformation approaches lack a clear security orientation so they are unable to capture the essence of security requirements, which, as opposed to functional requirements, act as restrictions on the means used for the achievement of goals.

To cover that need, certain security-oriented approaches have been developed. In [START_REF] Séguran | Secure workflow development from early requirements analysis[END_REF], SecureBPEL is introduced as an extension of the BPEL execution standard enriched with constructs from the Secure Tropos goal-oriented framework, to enforce delegation and trust requirements in web services used to support the designed business process. In [START_REF] Paja | Security Requirements Engineering for Secure Business Processes[END_REF] the SecCo (Security via Commitments) framework is introduced for the elicitation of security requirements that need to be fulfilled by the organisation's business processes, through the modelling and analysis of objectives, roles and social commitments between actors. Similarly in [START_REF] Salnitri | Transforming Socio-Technical Security Requirements in SecBPMN Security Policies[END_REF], transformation rules expressed in SecBPMN are used to introduce security requirements, identified using STS-ml, to existing BPMN process models.

Nevertheless, such attempts are unable to incorporate concepts and mechanisms to deal with the whole range of security requirements and also take into account elements of risk analysis (e.g., threats). As a result, in order to cover all aspects of risk and security a number of such approaches have to be used simultaneously, leading to a large overhead in time and specialised personnel and a high level of complexity. In addition, the simple annotation of existing process models with elements of security is not aligned with the notion of "security by design", which requires the derivation of such process designs from high level, security-and risk-aware organisational models. Moreover such attempts cannot adequately capture and reflect the rationale behind security decisions at an appropriate level of abstraction as they usually just impose general restrictions on the interactions between participants of the process (i.e., at conversation diagram level) but not on their specific activities (i.e., workflow level).

Proposed Approach

MARBLE TM Framework

MARBLE TM is a technique and a tool that supports business process archaeology by retrieving business processes from legacy source code [START_REF] Pérez-Castillo | Business process archeology using MARBLE[END_REF]. MARBLE TM utilises an extensible, ADM-based framework for recovering business processes. To achieve that: (i) the information is collected into and is used from standard KDM (Knowledge Discovery Metamodel) [START_REF]ISO/IEC 19506: Information technology -Object Management Group Architecture-Driven Modernization (ADM) -Knowledge Discovery Meta-Model (KDM)[END_REF] repositories and (ii) the information of KDM repositories is used to retrieve business process models [START_REF] Pérez-Castillo | A family of case studies on business process mining using MARBLE[END_REF].

MARBLE TM focuses on the reverse engineering stage of the re-engineering process. It proposes four abstraction levels (with four different kinds of models) as well as three model transformations between them, in order to cover the whole path of the business process archaeology method between legacy information systems and business processes (see Fig. 1). The four generic abstraction levels proposed in MARBLE TM are the following:

-Level L0. As the lowest level of abstraction, L0 represents the legacy information system (LIS) in the real world as a collection of different software artefacts (e.g. source code, database, documentation). -Level L1. This level consists of several specific models, i.e., one model for each different software artefact involved in the archaeology process (e.g., source code, database, user interfaces). These models are considered to be PSM (Platform-Specific Models) since they depict the software artefacts according to their specific technology or platforms. -Level L2. It consists of a common PIM (Platform-Independent Model) which represents the integrated view of the set of PSM models at L1. The standard KDM metamodel is used for this purpose, since it makes it possible to model all the artefacts of the legacy system in an integrated and technological independent manner. -Level L3. As the highest level of abstraction, L3 represents a computational independent model of the system. It depicts the business processes retrieved from the knowledge concerning legacy information systems represented in the KDM repository at L2. Business process models at L3 are represented according to the BPMN (Business Process Model and Notation) metamodel [START_REF]Object Management Group: Business Process Model and Notation (BPMN) Version 2.0[END_REF].

MARBLE TM provides a Java parser to obtain code models, which are transformed and integrated in a model repository according to the KDM standard. After that, KDMs are transformed to business process models by applying business pattern recognition. Finally, the tool allows the discovery, visualisation and editing of business process models. An in-depth elaboration of the framework's functionality and capabilities is provided at [START_REF] Pérez-Castillo | Business process archeology using MARBLE[END_REF][START_REF] Pérez-Castillo | MARBLE: Modernization approach for recovering business processes from legacy information systems[END_REF].

IBUPROFEN

Business process models derived via the reverse engineering approach followed by MARBLE TM often require some refinement before they can be utilised for further transformations. For such purposes the IBUPROFEN (Improvement and BUsiness Processes Refactoring OF Embedded Noise) approach has been developed, which introduces a set of algorithms for the refactoring of business process models expressed in BPMN [START_REF] Fernández-Ropero | Graph-based business process model refactoring[END_REF]. It introduces a set of ten refactoring algorithms which can be applied on business process models represented by graphs, expressed in BPMN. These ten refactoring algorithms are divided into three categories regarding their purpose, namely: maximization of relevant elements, fine-grained granularity reduction and completeness. An overview of the refactoring performed by each of these algorithms is provided in Fig. 2 and in [START_REF] Fernández-Ropero | Assessing the best-order for business process model refactoring[END_REF].

Secure Tropos

Secure Tropos [START_REF] Mouratidis | Secure Tropos: A Security-Oriented Extension of the Tropos methodology[END_REF] is a security-oriented extension of Tropos, a goal-oriented requirements engineering method. This extension includes the concept of security constraint which is defined as a restriction related to security issues, such as privacy, integrity, and availability [START_REF] Mouratidis | From Goal-Driven Security Requirements Engineering to Secure Design[END_REF]. Security constraints can influence the analysis and design of the information system under development by restricting some alternative design solutions, by conflicting with some of the requirements of the system, or by refining some of the system's objectives. In addition, Secure Tropos defines secure dependencies which introduces security constraints that must be fulfilled for the dependency to be satisfied. A security mechanism represents potential solutions for the implementation of the security constraints, leading to the fulfilment of security objectives. The advantages of this approach, compared to other security-oriented software engineering approaches are: i) its ability to perform social analysis during the early requirements stage, ii) the simultaneous consideration of security with the other requirements of the system-to-be, iii) the support for not only requirements stages but also design stages.

Model Transformations

A series of transformation rules need to be defined in order to facilitate the transition from business process models, expressed in BPMN and derived from legacy source code using the MARBLE TM framework (Fig. 3 Phase 1 ), to Secure Tropos goal models. This process-to-goal transformation will create an additional, higher level of abstraction, represented by a goal model of the legacy system. At this level of abstraction it is easier for non-tecnhical stakeholders to elaborate on the overall system security by defining certain easily comprehensible constraints. Such constraints can be captured by the Secure Tropos goal model and mapped back onto the process model, in order to be implemented during the redesign of the legacy systems. Essentially, the proposed transformation aims to derive a goal model, on which security will be elaborated and expressed using Secure Tropos. A goal-toprocess transformation can then be performed, beginning from the Secure Tropos goal model and deriving a secure business process model, used as input for the legacy system redevelopment via the MARBLE TM framework. The overall process, containing an extra level of abstraction accommodating the securityoriented, goal model reasoning is illustrated in Fig. 3 and summed-up in Subsection 3.5.

Transformation rules have been defined which map Secure Tropos and BPMN concepts to each other and provide instructions on how the transformation can take place. Such mappings are based on conceptual similarities between the paired concepts, identified after semantic analysis of the formal documentation and meta-models of the two modelling approaches [START_REF]Object Management Group: Business Process Model and Notation (BPMN) Version 2.0[END_REF], [START_REF] Mouratidis | Secure Tropos: A Security-Oriented Extension of the Tropos methodology[END_REF]. A process-to-goal transformation algorithm has been defined at Table 1, utilised in order to transform the refactored process model by IBUPROFEN (Fig. 3 Phase 2 ) to a Secure Tropos goal model (Fig. 3 Phase 3 ).

Table 1. Algorithm for Phase 3 of the transformation process

Step 1

For each lane (l) of the process model: Create a corresponding actor a(l) in the goal model.

Step 2

For each sub-process (p) of the process model: Create a corresponding goal g(p) in the goal model. For each of the sub-activities (p ) of p:

Create a corresponding sub-goal g(p ), within g(p).

Step 3

For each data object (d) of the process model: Create a corresponding resource r(d) in the goal model.

Step 4

For each message exchange (m) of the process model, between two activities (ps, pr) in two different lanes (ls, lr): Create a dependency link dl(m) in the goal model, from the dependent goal (g(ps)) to the dependee actor a(lr).

Step 5

For each exclusive or inclusive gateway (x) between sub-activities (p1, ..., pn) of the process model: Create an OR or AND decomposition or(x) of the corresponding goals (g(p1), ..., g(pn)) in the goal model.

By the application of the above transformation rules to a process model derived by the MARBLE TM framework and refactored using the IBUPROFEN algorithms, a basic Secure Tropos goal model can be produced. This basic goal model is the main input upon which the security elaboration of the system will take place by stakeholders of the organisation. As a result of this security elaboration, security constraints, objectives and mechanisms are added to the Secure Tropos goal model to capture the security aspects that will be introduced to the legacy system during its redesign (Fig. 3 Phase 4 ).

The security-oriented concepts of Secure Tropos (i.e., security constraints, mechanisms and threats) cannot be directly mapped onto existing BPMN concepts. Therefore, some manual tasks need to be performed in order for the process model to reflect the security choices captured at the goal model level (Fig. 3 Phase 5 ). Table 2 presents an algorithm providing a precise set of instructions for performing such goal-to-process refinement tasks.

Table 2. Algorithm for Phase 5 of the transformation process

Step 1

For each goal (g(p)) or resource (r(d)) of the goal model, restricted by a security constraint (sc): Annotate the corresponding activity (p) or data object (d) of the process model.

Step 2

For each security mechanism (sm) of the goal model: Create a ''secure" activity (sp) in the process model, connected to the annotated activities (p) or data objects (d).

Step 3

For each threat (t) on a goal (g(p)) or resource (r(d)) of the goal model: Create a corresponding error event (e) in the process model, connected to the threatened activities (p) or data objects (d).

Overview of Approach

As illustrated in Fig. 3, the proposed approach consists of the following phases:

1. Extraction of BPMN process models from the source code of the legacy system using the automated MARBLE TM tool [START_REF] Pérez-Castillo | MAR-BLE. A business process archeology tool[END_REF]. 2. Refactoring of the extracted process model using the IBUPROFEN algorithms, automated via an Eclipse plugin [START_REF] Fernández-Ropero | Graph-based business process model refactoring[END_REF]. 3. Process-to-goal transformation using the algorithm of Table 1 to create an initial goal model from the refactored BPMN process model. 4. Security elaboration for deriving security requirements, threats and security mechanisms using the Secure Tropos approach via the SecTro tool [START_REF] Pavlidis | A CASE tool to support automated modelling and analysis of security requirements[END_REF]. 5. Process model refinement using the algorithm of Table 2 for the addition of the security features elaborated at the Secure Tropos goal model.

The result of the application of above approach is a secure business process model, aligned with the high-level enterprise security objectives. This process model, which operationalises the security requirements captured at the goal model level, can be then used as input for the legacy system redevelopment effort, as proposed by the MARBLE TM framework. Therefore the security features introduced at a high level from the organisation's stakeholders will be included at the legacy system during its modernisation.

Illustrative Example

System Description

JBooks 1 is a Java-based personal finance application utilising a checkbox based interface that allows users to insert and visualize transactions. It is interfaced with a relational database, and involves a double-entry system for all transactions (i.e., every transaction involves a transfer from one account to another). A module of the JBooks application was selected for the purposes of this example. This module receives a string as input and if it is numeric it converts it to text in order to be further utilised by other modules of the application.

Method Application

The first phase of the method application is the extraction of a process model from the source code of the JBooks application. By using the MARBLE TM tool we extracted a large amount of process models for the different modules of the JBooks application. For this example we selected a relatively simple process model representing the module that converts numerical strings to text.

After the initial process model is extracted via the MARBLE TM tool it is refactored by applying the algorithms of IBUPROFEN. During refactoring some elements of the process model are replaced by equivalent ones or merged to reduce the complexity of the overall model. Since the refactoring process does not fulfill the commutative property, the order of the application of the algorithms is critical as it can define the quality of the outcome model [START_REF] Fernández-Ropero | Assessing the best-order for business process model refactoring[END_REF]. The optimal execution order that maximises the understandability and modifiability of the process model has been experimentally identified as: first applying the granularity reduction set of algorithms, then the irrelevant elements reduction set of algorithms and finally the completeness algorithms [START_REF] Fernández-Ropero | Assessing the best-order for business process model refactoring[END_REF]. The IBUPROFEN algorithms are implemented as a plugin of the Eclipse TM environment on the process model extracted by the MARBLE TM tool. In our example, after applying the refactoring algorithms, the process model illustrated in Fig. 4 is derived. Next, the transformation of the derived process model to a Secure Tropos goal model need to be performed. By applying the algorithm in Table 1 to our example one actor is created to correspond to the lane of the process model (Step 1), each sub-process and task is transformed to a (sub-)goal (Step 2) and resources are created, corresponding to the data object of the process model (Step 3). In addition to the transformation steps defined by the algorithm, an extra root-level goal has been added to provide context to the derived Secure Tropos goal model, modelled using the SecTro tool [START_REF] Pavlidis | A CASE tool to support automated modelling and analysis of security requirements[END_REF], as illustrated in Fig. 5. As goal models in general, and Secure Tropos in our case, do not provide the means to capture temporal dimensions (i.e., the sequence of goal achievement), the resulting models cannot always capture all the information contained in process models. In our example, the application of Step 5 of the transformation algorithm cannot sufficiently capture in the goal model the fact that the activity "Get Object" is followed by either "Text handling resource" or "Number to Text resource". This is due to the fact that Secure Tropos does not offer special notation for illustrating OR decompositions or the specific sequence of execution of goals. In order to resolve this issue a new goal had to be manually added ("Handle object") which includes the two alternatives (i.e., "Text handling resource" or "Number to Text resource") as sub-goals and is connected with an AND relationship with the "Get Object" sub-goal.

During security elaboration process the system stakeholders can express their security requirements and define the basic mechanisms to implement them, using the goal model as a high level representation of the application. For simplicity purposes, our example includes one security constraint, concerning the validity of the input. It is related to the integrity of the input data and can be implemented by a security mechanism validating that it has not been altered before it reached the module. A threat has also been included in the goal model representing the malicious alteration of the module's input by a third party. The complete, security-annotated goal model is presented in Fig. 6.

Finally, the security introduced at the goal model level has to be transferred back to the initial process model, by following the steps defined in Table 2. The finalised secure process model, illustrated at Fig. 7, now includes a secure task, denoted by a padlock symbol, representing the data validation security mechanism. The "Get Object" task is annotated with a red border to denote Fig. 6. Security-annotated goal model of JBooks module that it is security constraint while it is also an error event, annotated as an orange circle, is attached to represent the malicious data modification threat.

Lessons Learned

The addition of security in a module of the JBooks legacy system provided insights concerning the completeness and applicability of the proposed approach. Even though the example used was rather limited in size and complexity, we were able to successfully complete each step of our approach without any major complications. Some manual intervention was necessary after the refactoring of the process model in order to make the produced model more readable (e.g., reshaping and spacing elements and association links). Moreover the seamless transition between its different components added to the value of the approach, facilitated by the fact that the output for each phase can be used quite effortlessly as the input of the next. The availability of CASE tools (e.g., MARBLE TM tool, IBUPROFEN plugin, SecTro tool) further contributed in the aspect of automation, as most phases, with the exception of the goal-to-process transformation, required minimal manual efforts. By expanding and interfacing the available support tools, this automation can be further strengthened in the future.

Regarding the transformation process, one addition to the proposed algorithm consisted of creating a root-level goal in the produced goal model, which was decomposed to the rest of the goals and encapsulated the overall purpose of the module. This was performed for reasons of completeness and comprehensibility of the goal model by stakeholders and had no further impact on the rest of the approach. Another point requiring further attention is the inadequacy of goal models to capture the exact sequence by which their (sub-)goals should be accomplished, especially when complex branching (e.g., inclusive, exclusive gateways) is present at the process model. This led to the need for some manual intervention during the fifth step of our transformation algorithm, as explained in the previous section. To address this issue in the future, extensions at the notation of Secure Tropos will be explored, along with the refinement of the transformation rules defined in the algorithm.

Conclusion

The modernisation of enterprise legacy systems can be a demanding and time consuming endeavour. In order to facilitate that process, the MARBLE TM framework has been developed for the extraction of process models from legacy source code. Such process models offer a more comprehensible and flexible platform for the elaboration of potential redesigns of the legacy system in question. The IBUPROFEN framework was also developed since the extracted process models often required some refinement (e.g., removal of excess notation, completeness).

In this work we extend these frameworks by introducing an algorithmic approach for the transformation of the derived business process models to goal models. Goal models provide the means necessary for the elaboration of security for the redesigned legacy system, at a high abstraction level, comprehensible by non-technical stakeholders and aligned with organisational objectives. Using a set of transformation rules, goal models can be created based on such business process models. Secure Tropos offers the means for capturing the security related aspects of the redesigned system (e.g., security constraints, mechanisms, threats), which can then be incorporated back into the process model via a set of goal-to-process transformation rules. As a result, security choices of the system's stakeholders can be operationalised by the redesigned business processes.

An illustrative example of a legacy system module was utilised as a proof of concept for the proposed transformation approach and led us to useful conclusions about its completeness and effectiveness. Its application resulted in an accurate goal model representation of the selected legacy system's module, upon which security was successfully elaborated and then introduced back into the process model. Some complications sourced from certain elements of process models (i.e., sequence of execution, branching) which cannot always be translated to goal modelling concepts without losing certain information. Nevertheless, this example provided valuable insight on the applicability of the proposed approach while it also brought into consideration aspects which require further attention.

Overall, this novel approach could be a valuable tool for both practitioners and researchers, attempting to introduce security to existing business processes, starting from a high level of abstraction, which allows the alignment of security choices with the overall organisational strategy. Despite the emphasis in business processes extracted from legacy source code, the transformation algorithms introduced by this approach can be utilised for the introduction of security to any available process model, newly designed or already existing. This approach will also be integrated in the extraction activity of a migration process of legacy systems to the cloud (SMILE2Cloud) in which we are currently working [START_REF] Márquez Alcañiz | A Framework for Secure Migration Processes of Legacy Systems to the Cloud[END_REF][START_REF] Shei | Modelling Secure Cloud Systems Based on System Requirements[END_REF].

Future work will look into the formalisation of the existing transformation algorithms using QVT and the potential addition of further steps or activities in order to eliminate any flaws during the transition between goal and process models and vice versa. As soon as a set of concrete transformation rules has been explicitly defined via an appropriate formal language, already existing support tools (e.g. SecTro tool, Eclipse plugins) can be further extended to automate the majority of this transformation, thus limiting the need for manual intervention. Finally, the validation of this approach via a case study would add great value, especially if it involves a large and more complex enterprise legacy system along with the participation of its stakeholders and analysts.

Fig. 1 .

 1 Fig.1. MARBLE TM , a framework to support business process archaeology[START_REF] Pérez-Castillo | Business process archeology using MARBLE[END_REF]

Fig. 2 .

 2 Fig. 2. Process model refactoring algorithms introduced by IBUPROFEN [33]

Fig. 3 .

 3 Fig. 3. Extended framework to accommodate goal model reasoning

Fig. 4 .

 4 Fig. 4. Process model of JBooks module

Fig. 5 .

 5 Fig. 5. Derived goal model of selected JBooks module

Fig. 7 .

 7 Fig. 7. Secure BPMN process model of JBooks module

Available at: http://freshmeat.net/projects/jbooks/

Acknowledgments. This research is part of the following projects: SERENIDAD (PEII11-037-7035) financed by the "Viceconsejería de Ciencia y Tecnología de la Junta de Comunidades de Castilla-La Mancha" (Spain) and FEDER, and SIGMA-CC (TIN2012-36904) financed by the "Ministerio de Economía y Competitividad" (Spain).


M Moser

C Ranzenberger

Semi-Automated Bonding of OSR -Qualification of a novel Process

Optical Solar Reflectors (OSR) are efficient thermal emitter glass tiles with a typical size of 40x40mm. They cover spacecraft radiator panels to reduce absorption of solar radiation and to dissipate internally generated heat into space. On modern high-power telecom satellites total radiator areas reach sizes of more than 20m 2 . State-of-the-art processes to apply such OSR tiles are labour intensive and involve application of two-component adhesives, manual placing of tiles and long duration temperature controlled adhesive curing cycles. This paper presents the qualification campaign of a sophisticated OSR application method using electrically conductive pressure sensitive adhesive (PSA) and a semiautomated OSR pick-and-place facility. Compared to standard OSR application using electrically conductive filled silicone resins, the new process is resulting in radiator surfaces with up to 27% lower mass. After manual application of the PSA the panel is placed in the 3axis controlled gantry system, where a precise manipulator takes each tile and places it on the CAD pre-defined position on the panel. When the panel is covered with OSR an automated rolling process applies the required pressure to activate tape adhesion. The application process in the pick-and-place system guarantees high degree of reproducibility and increased precision at decreased radiator through-put durations. For qualification, samples prepared with the automated process were subjected to a thorough space environmental test campaign. This campaign involved vacuum thermal-cycling and exposures to electrons, protons and UV-radiation simulating a 15 year GEO mission, followed by tile pull-off testing. Since successful completion of the qualification campaign a number of spacecraft radiators have been equipped with single sizes up to 2,1 x 2,2 meters including radiators of the SmallGEO, Exomars and EDRS-C programs.

Nomenclature

I. Introduction

SR tiles, are made of cerium dioxide doped borosilicate glass coated with a silver second-surface and a thin, transparent, and electrically conductive Indium Tin Oxide (ITO) space facing layer, which is applied optionally by the tile supplier.

Tiles are attached on spacecraft radiators to reflect incident solar energy of wavelengths between 200nm and 2500nm, and to emit in the infrared spectrum the waste heat energy produced within the spacecraft. [START_REF] Gilmore | Spacecraft thermal control handbook[END_REF] An effective radiator must thus have a low ratio of absorption to emissivity. This ratio is defined , where  is the solar absorption coefficient and  the infrared emissivity of the material, and is typically in the order of 0.06 to 0.12 depending on the OSR type. [START_REF] Qioptiq | Space Technology Product Specification for the Manufacture and Quality assurance of Low Absorptance conductive coated Second Surface Mirrors[END_REF][START_REF] Qioptiq | Space Technology Product Specification for the Manufacture and Quality assurance of CMX Second Surface Mirrors with conductive coating for thermal control with electrostatic discharge protection[END_REF] On modern high-power telecom satellites, total radiator areas can reach sizes of more than 20 m 2 requiring the application of a large numberi.e. several thousandof OSR tiles which are typically supplied in sizes of 40x40mm. These tiles have to be placed and spaced apart precisely to cope with differential expansion and contraction between spacecraft structure and OSR glass.

Bonding of tiles to spacecraft panels is in common practice performed manually and involves processes such as the application of two component silicon adhesives, placement of OSR tiles, filling of interstices between tiles with conductive resin to prevent electrostatic charging and a low pressure temperature controlled adhesive curing cycle. After application often a cleaning step has to be performed to remove excess adhesive from OSR surfaces. [START_REF] Sierra | Development of a specific OSR automated bonding process[END_REF] Accordingly, this construction technique results in high radiator cost due to the extensive labor involved and considerable risk for breakage of tiles due to manual handling and cleaning.

In order to improve the state-of-the-art technique a new process has been developed. OSR tiles are automatically bonded using a computer controlled pick-and-place facility on radiator panels equipped with electrically conductive pressure sensitive adhesive tape.

This paper provides in a first part an introduction into the new process and presentation of the pick-and-place facility (Figure 1). The second part of the paper describes the qualification program and tests performed to verify end of life process reliability.

II. Application Process

The OSR application process applied at RUAG Space consists of three main steps:

1) Cleaning of radiator surfaces and application of PSA tape 2) Precise placement of OSR tiles using the automated pick-and-place facility 3) Activation of tape adhesion by an automated rolling process

A. Application of tape

After cleaning of radiator facesheet surfaces an electrically conductive tape is manually applied in strips of 1 inch width separated by 1mm from each other. This gap enables venting of tape intrinsic air and of residual air pockets from tape application.

Electrical conductivity from OSR surfaces to the aluminium facesheets is guaranteed via ITO coated OSR lateral faces.

The tape applied and qualified has long heritage in MLI manufacturing and application of second surface mirror foils. By providing a contact resistance of <10 /cm 2 , the tape has a thickness of 50µm and a mass of only ~80 grams/m 2 .

With the given weight of the OSR tiles the low mass of the adhesive results in major mass savings compared to standard application processes. While techniques using two component silicon resins might weight more than O International Conference on Environmental Systems 3 650 g/m 2 , radiator surfaces on panels equipped with the herein described process weight ~470 g/m 2 , which corresponds to a considerable mass saving of ~27%.

In addition, the new process does not result in lump adhesive resin material at OSR interstices which has to be manually removed and requires delicate cleaning processes in standard techniques.

B. Automated OSR placement

During tape application radiator panels are fixed on a tilting trolley equipped with a facility interface table which provides an M6 threaded inserts attachment array of 150x150mm. The table has a size of 2500x2700mm, which corresponds to the maximum size of panels that can be automatically equipped with OSR using the RUAG Space developed pick-and-place facility presented in Figure 1.

After tape application the table with the radiator panel attached is inserted into the OSR pick-and-place facility and accurately aligned to the machine main axes. The facility is a 3-axis controlled gantry system, where a precise manipulator takes tiles from a 100 OSR depot, which is manually fed by the operator, and places them on the CAD pre-defined positions on the panel at a precision of ±0.05mm.

The machine is equipped with a number of interchangeable manipulator tools which allow placing between one and 100 OSR tiles of 40x40mm at a time. Independent from the selected tool, tiles are placed in a cadence of less than 30 seconds anywhere within the traversing range of the facility manipulator arm.

Apart from restocking of tiles in the OSR depot the pick-and-place process is fully automated and does not require manual interaction.

C. Activation of tape adhesion

To achieve full adhesion of OSR tiles to the underlying tape and panel, pressure has to be applied to the film. By outfitting the facility with a flexible rolling tool a predefined force is applied with a constant velocity rolling process. Subject to radiator complexity rolling is done fully automated or remote controlled by the facility operator.

After activation of tape adhesion the OSR equipped radiator panel is removed from the facility and cleared for product assurance inspection.

III. Qualification Program

Qualification of the new process was a multistep program starting with an entirely manual process which was then transferred to the semi-automated approach detailed herein.

A. Test Campaign

The qualification campaign, as presented in the flowchart Figure 2, is based on thermal-and space environmental exposures followed by electrical, thermo-optical and mechanical material qualification testing.

Samples were thermally cycled in accordance to the requirements of spacecraft development programs between -70°C and +90°C in two exposure campaigns -see paragraph IV. Thermo-optical properties, electrical conductance and OSR tile adhesion were measured of test coupons before and after exposure.

In addition two space environmental exposure campaigns were performed. The first consisted of only electron irradiation selected to test the OSR tile adhesion after intense 15 year GEO representative radiation bombardment.

The second environmental test campaign included 8 year representative GEO exposure with UV, electrons and protons and a subsequent 7 year exposure to electrons and protons. This campaign was intended to test the interaction of OSR tiles with the environment and measure stability of thermo-optical properties and electrical conductance.

B. Test Materials

All tests were performed with OSR type PS344 of thickness 150µm supplied by QIOPTIQ Space Technology. The OSR type PS344 has a typical solar absorptance of ≤0.010 and infrared emittance of ≥0.80. Front-to-back electrical resistance is defined <200kΩ. [START_REF] Qioptiq | Space Technology Product Specification for the Manufacture and Quality assurance of CMX Second Surface Mirrors with conductive coating for thermal control with electrostatic discharge protection[END_REF] Samples were bonded to aluminium facesheets in sizes as required by the testing facility.

IV. Exposures

A. Thermal Cycling Thermal cycling tests were performed in accordance with ECSS-Q-70-04 -see Ref. 5-at the ESA certified space materials test house Aerospace & Advanced Composites GmbH, Austria.

Two exposure runs were performed in vacuum <1x10 -5 mbar. The first covered the spectrum of the low Earth orbit GOCE mission with a temperature cycling envelope between -70°C to +70°C. 100 cycles were performed with a dwell time of 10min.

The second test was performed for the SmallGEO geostationary satellite bus. The temperature program consisted of 100 cycles between -60°C and +90°C followed by 60 cycles between -45°C and +75°C. The first 100 high temperature cycles were intended to cover possible loss of attitude cases during the nominal 15 year mission, the second 60 cycles were added to cover the nominal temperature environment.

B. Space Environmental Exposures 1. Facility

The facilities named SEMIRAMIS and GEODUR were designed at ONERA for the evaluation of thermal control coatings in a simulated space environment, especially GEO orbits. Their main characteristics are cleanliness -very low organic residual partial pressures in vacuum-and reliability allowing to keep samples in vacuum for several months.

The proton and electron beams are supplied, respectively, by 2.5 and 2.7MV Van-de-Graaff accelerators. The protons are obtained from plasma of pure hydrogen and separated from other charged species by a magnetic mass analysis after acceleration. In order to irradiate the samples, protons are swept across the sample holder surface. In the case of electrons, the beam is diffused through a thin aluminium window.

The solar UV generator is based on 6.5kW short arc Xenon sources, whose spectral distribution in UV is close to that of the sun.

In both facilities, vacuum lower than 1x10 -6 mbar was obtained after a 1-day pumpdown period and 3x10 -7 mbar at the end of the test. The sample holder temperature was maintained at 40°C for the duration of the test. Both exposures were conducted in accordance with the relevant standards Refs. 6, 7.

Test Conditions 1.1 15-year GEO representative electrons

15-year GEO representative electron irradiation was performed in the GEODUR facility. A dose of 620Mrad was deposited on OSRs with a mean current of 30nA/cm 2 using a 1MeV electron beam with a fluency of 2x10 16 e-/cm 2 .

Thermo-optical measurements were performed in air before and after electron irradiation. As 1 MeV electron irradiation mainly affects OSR material thickness of 10 -1000µm this test was intended to measure degradation of the PSA interface and tile adhesion.

8-year full GEO irradiation and 7-years representative protons and electrons

The test was divided in two steps; 8-years equivalent irradiation with UV, electrons and protons and 7-years equivalent in particles only resulting in a total accumulated irradiation dose of 219.8Grad.

The first step was the UV exposure under 8897 Equivalent Solar Hours (ESH) with solar constants varying between 7 and 9.

On GEO, the dose profile inside a material due to the interaction with trapped electrons and protons decreases rapidly versus the material thickness. Figure 4 shows the space-dose profile calculation (based on trapped particles evaluated with AE8 and AP8 models) corresponding to 15-year in GEO inside a reference material of OSR density 2,7 g/cm [START_REF] Qioptiq | Space Technology Product Specification for the Manufacture and Quality assurance of CMX Second Surface Mirrors with conductive coating for thermal control with electrostatic discharge protection[END_REF] . Simulation of this profile was performed with one electron energy affecting the material bulk and with two proton energies, which mainly interact with the mirror surfaces.

8-year GEO corresponding electron exposure was conducted at a fluency of 8x10 15 e-/cm 2 of 400keV electrons with a mean current of 13nA/cm 2 .

Irradiation with 240keV and 45keV protons was performed at fluencies of 1.6x10 15 p+/cm 2 and 1.6x10 16 p+/cm 2 , respectively, corresponding to 8year GEO proton exposure with a mean current of 25nA/cm 2 . After each of the irradiation steps, solar reflectance measurements were performed in-situ under vacuum.

In the second part of the test, samples were exposed to the following 7 year GEO representative particle environment: In summary the above data indicates that both, UV and electron exposures increase absorptance of the tested OSR type. The most significant degradation is however measured after combined electron and proton irradiation, where, after 15 year equivalent GEO exposure, a more than doubling of  S was observed.

Further, the importance of in-situ testing was underlined by recovery effects that were found to take place in reflectance properties between measurements taken in vacuum and those taken ex-situ in air, where absorptance has recovered to 0.151±0.001. Absorptance data of the pristine, BOT OSR tiles was not different in in-situ and ex-situ measurements.

Figure 6. In-situ taken reflectance spectra

Reflectance spectra taken during the 8 year full GEO irradiation and 7 year GEO representative electron and proton radiation are presented in Figure 6.

Decreases are measured in the visible wavelength range between app. 350 and 800nm. Also in the infrared, decreases are observed in reflectance from approximately 0.97 to 0.90 between 800 and 2500nm.

Comparable degradation of OSR absorptivity after environmental exposures are reported in literature. Marco et. al. [Ref. 9] describe an increase in  S from ~0.085 to ~0.108 of an ITO coated OSR after 3 year simulated GEO environment including 3336ESH UV, proton and electron irradiation. An increase in absorptance by 0.021 was published by Ding et. al. after irradiation with 15 year GEO representative low energy electrons. Both reports consider a degradation of the ITO top coating as main source for the increase in absorptance.

Infrared Emittance

Results of the thermal emittance measurements before and after exposures are presented in Table 1. While changes in emittance after thermal cycling were within the error of measurement, small increases of 0.003, above the standard deviation of the test, were found after 15 year GEO representative electron exposure. Still this change is also within the measurement uncertainty.

A significant increase of 0.018, even above the measurement accuracy of the equipment, is measured in  IR after exposure to 8 year full GEO irradiation followed by 7 year GEO representative electron and proton radiation.

No literature reports were found for this phenomenon. Possible explanations could range from microscopic surface roughening by proton sputtering, oxidation in air after vacuum exposure or surface contamination during testing.

VII. Pull-Off Testing

A. Test Set-Up Pull-off testing was performed in ambient conditions using a custom made tensile test facility equipped with a 500N load cell. After exposure 5mm aluminum interface plates of size 40x40mm were bonded on each OSR using 966PSA. By connecting a steel wire to the center of the plate the pull-off force was applied.

B. Success Requirement

Including margin the mass of one OSR with conductive PSA is 1 gram. With the assumption of a maximum acceleration of 200g including tolerances and safety margins the minimum pull-off strength required to withstand launch loads is 2N.

C. Test Results

Pull-off test results of pristine, BOT, samples are compared to data measured after thermal-and environmental exposure and presented in Figure 7. A minimum of three samples were tested.

The average force for OSR pull-off is 75N at BOT, which corresponds to a margin of safety of 37 to the required minimum strength of 2N.

After thermal cycling to -70°C/+70°C or -60°C/+90°C and -45°C/+75°C pull-off forces measured were 67N and 69N, respectively. This corresponds to a decrease of ~10% but a residual MOS of approximately 34.

Pull-off strength after exposure to 6x10 8 rad electron irradiation was measured 64N, which still corresponds to a MOS of 32 after full 15year GEO mission duration.

The data show that a large margin of safety is given even after exposures to loads which exceed launch forces. Considerably lower forces are to be expected in orbit during nominal satellite operation.

VIII. Conclusion

A sophisticated process for OSR application has been developed at RUAG Space, which combines bonding of tiles with electrically conductive PSA and precise placement using an automated pick-and-place facility.

After manual application of PSA, up to 100 OSR tiles at a time are automatically applied on radiator panels of sizes up to 2500x2700mm in a 3-axis controlled gantry system and at a cadence of less than 30 seconds. A force controlled automated rolling process is employed to activate the adhesive and achieve final adhesion of OSR.

Qualification of the process was performed by thermal cycling tests and 15 year GEO representative space environmental exposures. While thermal cycling tests triggered no changes, thermo-optical property measurements revealed an influence of UV or electron irradiation and considerable increase of absorptance by 117% after 15 year GEO representative proton and electron exposure.

Pull-off tests showed that an average force of 75N has to be applied to detach automatically bonded OSR, which corresponds to a margin of safety of 37 to the required minimum strength of 2N. Small decreases in pull-off forces are measured after thermal and environmental exposures but safety margins are still above 30. No influence of exposures on OSR electrical conductivity was measured.

Since successful completion of the qualification campaign a number of spacecraft have been equipped with OSR using the new process. OSR bonded with conductive PSA by RUAG Space have gained flight heritage on GOCE, VenusExpress and GAIA missions, and the automated application facility has been proven efficiency when radiators were equipped for the SmallGEO and Exomars programs.

  Oxide conductive coating 1 Systems Engineer, Thermal Systems, RUAG Space GmbH, Stachegasse 16, A-1120 Vienna, Austria 2 Manager Engineering Space, Thermal Systems, RUAG Space GmbH, Stachegasse 16, A-1120 Vienna, Austria 3 Head of ECM group, Space Environment Department (DESP), ONERA, 2 Av.Edouard Belin, F-31055 Toulouse CEDEX 4, France International Conference on Environmental Systems 2 MOS = Margin of safety OSR = Optical Solar Reflector p+ = Proton PSA = Pressure Sensitive Adhesive UV = Ultra-Violet part of the electromagnetic spectrum

Figure 1 .

 1 Figure 1. OSR Pick-and-Place facility at RUAG Space

Figure 2 .

 2 Figure 2. Qualification Test Program

Figure 4 .

 4 Figure 3. ONERA space environmental exposure facilities

Figure 7 .

 7 Figure 7. Variation of pull-off strength in dependence of environmental exposure

Table 1 . Evolution of infrared emissivity

 1

	Test	 IR BOT	 IR EOT	 IR
	Cycling -70°C/+70°C	0.797±0.004	0.800±0.006	0.003
	15y GEO e-	0.815±0.001	0.818±0.001	0.003
	15y GEO UV, e-, p+	0.795±0.001	0.813±0.001	0.018

Acknowledgments

The authors acknowledge the financial support of the Austrian Research Promotion Agency (FFG) and the ARTES 11.3 programme.

-7x10 15 electrons/cm 2 of energy 400keV at a mean current of 22nA/cm 2 .

-1.4x10 15 protons/cm 2 of energy of 240keV at a mean current of 25nA/cm 2 .

-1.4x10 16 protons/cm 2 of energy of 45keV at a mean current of 28nA/cm 2 .

Again, solar reflectance measurements were performed in-situ under vacuum after electron and proton irradiations.

V. Electrical Conductivity

Resistance between OSR front surface and sample panel aluminium facesheet was measured using a FLUKE 77 digital multimeter.

In accordance with the OSR specifications the success criteria for front to structure electrical resistance was set <200kΩ. [START_REF] Qioptiq | Space Technology Product Specification for the Manufacture and Quality assurance of CMX Second Surface Mirrors with conductive coating for thermal control with electrostatic discharge protection[END_REF] BOT measurements revealed considerably better conductance than specified with front to structure resistance values ranging from app. 50Ω to 5kΩ.

No significant degradation in electrical resistance was measured after thermal or environmental exposures and all data stayed well within the requirement. EOT front to structure resistance values were measured ranging from approximately 50Ω to 6.5kΩ.

VI. Thermo-Optical Properties

A. Test Set-Up

Reflectance measurements were performed ex-situ in air, with a Perkin Elmer Lambda 1050 spectrophotometer associated with a 150mm integrated sphere. Reflection measurements are corrected by a specular aluminium etalon and balanced with the ASTM E490 solar spectrum. Absorptance  S was determined by subtracting the integrated reflectance spectrum from unity.

During the 15year exposure program involving UV and particles, solar absorptance was measured in-situ without breaking the vacuum, using a Perkin Elmer Lambda 1050 spectrophotometer with a 60mm integrating sphere. Solar absorptance values were measured with an accuracy of ± 0.005.

Normal infrared emissivity  IR was measured with an accuracy of ± 0.010 ex-situ with an AZ Technology TEMP 2000A.

All Thermo-optical measurements were performed in accordance to ECSS-Q-ST-70-09C. 8

B. Measurement Results

Solar Absorptance

The variation of solar absorptance  S of OSR type PS344 due to thermal and environmental exposures is presented in Figure 5.

The BOT value of the pristine material of 0.079±0.002 is an average calculated from 8 sample measurements taken throughout the test campaign.

Thermal cycling exposure did not reveal significant changes in absorptance with an average of 0.080±0.002 tested after cycling to -70°C/+70°C. However, exposure to simulated space environment with electrons, protons and UV leads to increases in solar absorptance. After 15 year GEO equivalent electron exposure an increase of 13% to 0.089±0.001 was measured.

In-situ measurements of absorptance performed without breaking vacuum during the 8 year GEO irradiation including UV and 7 year GEO representative electron and proton radiation allows distinguishing the influence of radiation types.

An increase of 15% to 0.091±0.001 was measured after 8897 ESH UV exposure. After the full 8 year equivalent GEO radiation dose, including protons and electrons, absorptance has increased significantly by 63% to