<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Modelling Business Processes for Outsourcing into the Fog and Cloud Computing</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Louar Fadila</string-name>
          <email>fadila.louar@univ-constantine2.dz</email>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Zarour Karim</string-name>
          <email>zarour.karim@univ-constantine2.dz</email>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Benmerzoug Djamel</string-name>
          <email>djamel.benmerzoug@univ-constantine2.dz</email>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>LIRE Laboratory, Faculty of NTIC, University of Constantine 2 - Abdelhamid Mehri</institution>
          ,
          <country country="DZ">Algeria</country>
        </aff>
      </contrib-group>
      <fpage>18</fpage>
      <lpage>31</lpage>
      <abstract>
        <p>Changes in economic environment force companies to be more flexible and performant. These goals can only be achieved through business process outsourcing (BPO) strategy; which reduces costs, gives companies the opportunity to focus on their core business and delegate secondary problems using capabilities offered by Cloud or Fog computing environments. The company must therefore consider multiple factors to determine which parts of the BP to be outsourced, and to assign them the appropriate outsourcing environment. In this paper, we propose an extension, of the BPMN language standard that allows specifying the requirements of BP activities in terms of security, compliance, cost, performance and storage space. The requirements of BP activities help to select the most appropriate Cloud/Fog service providers.</p>
      </abstract>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>Introduction</title>
      <p>Nowadays, whether it is a small or a big business, the way you store and access personal
and business information has taken a huge leap. In the past, businesses and institutions
use the resources of computers to store their data, run their applications or develop their
programs, but the cost of maintaining them on a regular basis and the difficulty of
ensuring their efficient operation have always been a concern for companies, governments
and institutions. As a result, they have begun to look for other solutions that ensure two
important factors: providing resources and working effectively.</p>
      <p>
        Cloud computing is a model for enabling ubiquitous, convenient and on-demand
network access to a shared pool of configurable computing resources (e.g., networks,
servers, storage, applications, and services) that can be rapidly provisioned and released
with minimal management effort or service provider interaction [
        <xref ref-type="bibr" rid="ref1">1</xref>
        ]. The Cloud
eliminates the need to invest in hardware and spend time on the technical complications of
managing this equipment as well, it frees the enterprises and their end users from the
specification of many details, such as storage resources, computation limitation and
network communication cost. However, this bliss becomes a problem for
latency-sensitive applications, which require nodes in the vicinity to meet their delay requirements
[
        <xref ref-type="bibr" rid="ref2">2</xref>
        ].
      </p>
      <p>
        Accordingly, a new paradigm called “Fog computing” appeared recently extends the
Cloud computing to the edge of the network, thus enabling a new breed of applications
and services. Similar to the Cloud, Fog provides data, compute, storage, and application
services to end-users. However, Fog can be distinguished from Cloud by its proximity
to end-users, the dense geographical distribution and its support for mobility. It
provides low latency, location awareness, and improves quality-of-services for streaming
and real-time applications [
        <xref ref-type="bibr" rid="ref2">2</xref>
        ]. These requirements deal with the Internet of Things
(IoT) requirements that make Fog computing as the appropriate platform for it [
        <xref ref-type="bibr" rid="ref3">3</xref>
        ].
      </p>
      <p>
        These technologies will bring several advantages in the management of business
processes of companies, including optimization and automation that will ensure their
agility and performance. Business process outsourcing (BPO) is one of the very few
business tools available to managers with the power to transform their organizations. It
enables companies to simultaneously re-engineer their existing operations and create a
more flexible and adaptable organizational structure [
        <xref ref-type="bibr" rid="ref6">6</xref>
        ].
      </p>
      <p>For better managing the outsourcing of business processes, companies must always
have a complete and detailed view of their operations and their internal structure to
identify those that require expertise from an external supplier. Business Process
modelling can provide this vision, it consists of representing and structuring all the activities
of a company based on a graphical modelling method.</p>
      <p>
        A new generation of languages and tools for process modelling has appeared.
Business Process Model and Notation (BPMN) is a standard for business process modelling
that is very common in professional practice due to its expressiveness, the well defined
meta-model and the possibility of workflow integration [
        <xref ref-type="bibr" rid="ref18">18</xref>
        ]. This standard focus on
providing a comprehensive and integrated notation for business process modelling by
giving graphical and informal notations targeted at analysts [
        <xref ref-type="bibr" rid="ref7">7</xref>
        ]. In addition, BPMN
offers the possibility to reuse its kernel to benefit from its advantages and to avoid the
expensive development of a domain-specific modelling language from the scratch by
allowing the representation of additional concepts and attaching them to its original
elements [
        <xref ref-type="bibr" rid="ref20">20</xref>
        ]. The processes of BPMN are assigned to services and executed later
through workflow engines such as Business Process Execution Language (BPEL) [
        <xref ref-type="bibr" rid="ref19">19</xref>
        ].
      </p>
      <p>Despite the various extensions proposed to define new specific-domains concepts
(healthcare, IoT, manufacturing, CPS) using the BPMN language, the lack of a
representation of some defined requirement that helps companies to define and recognise
which BP to outsource and which environment (Cloud or Fog computing) to choose is
needed. To fill the gap of which processes to outsource, we have defined the criteria of
security, performance, compliance, cost and data storage that every company should
consider it in the decision making of their outsourced BPs. Accordingly, we have
proposed for each criterion a graphical representation added in the element “Artifacts” of
the BPMN meta-model. Therefore, the proposed representation will help for sure the
actors of the system to decide which environment between Cloud and Fog computing
to consider it in outsourcing their BPs. The aim of this research is to propose a BPMN
extension for BPO to the Cloud or Fog Computing based on some defined requirements.</p>
      <p>The rest of the paper is organized as follow: Section 2 introduces some related work.
Section 3 discusses the concept of outsourcing BPs. Section 4 shows the BPMN
extension. Section 5 illustrates a use case of our BPMN extension in the telemedicine field.
Section 6 presents the tools used to implement the proposed extension and Section 7
concludes the paper.</p>
    </sec>
    <sec id="sec-2">
      <title>Related work</title>
      <p>Every day, developers are searching for a unified and standard tool in order to allow
companies to model their business processes (BPs) easily. Unfortunately, it is
impossible to reach this aim and this goes back to a company’s own requirements. Therefore,
different languages in modelling BPs were developed where BPMN was the most used
one thanks to its most feature that allows researchers to extend it according to their
specific domain.</p>
      <p>
        Several BPMN extensions were proposed to define a specific-domain. According to
[
        <xref ref-type="bibr" rid="ref8">8</xref>
        ], BPMN was used to incorporate security requirements into Business Process
Diagram, they considered that an explicit identification of them instead of using artifacts
will facilitate modelling and will give security specialists a better interpretation.
      </p>
      <p>
        While in [
        <xref ref-type="bibr" rid="ref9">9</xref>
        ], authors proposed a BPMN extension for evaluation and analysis of
BPs. Therefore, the BPMN meta-model can be extended to include the performance
details of business processes and business objects. In general, they used activities to
represent the computed performance data after its execution and artifacts to provide
other statistics and performance data about different objects such as organizational units
and events.
      </p>
      <p>
        Otherwise, in [
        <xref ref-type="bibr" rid="ref10">10</xref>
        ] authors proposed a BPMN extension for modelling
Cyber-Physical Systems (called BPMN4CPS), which provides a set of extensions for BPMN to
enable designers to properly and accurately cater for CPS elements, concepts, and
properties when modelling CPS processes. They defined CPS devices as technical process
participants, the real-world information as the physical entities and their information
that can be offered as a set of data objects, and then decomposing CPS business
processes into several pools (the physical processes, the cyber processes, and the central
controller) where each part has its own type of activities that can be performed.
      </p>
      <p>
        The work in [
        <xref ref-type="bibr" rid="ref22">22</xref>
        ] studied the advances in Cloud computing and discussed the benefits
of using Cloud services for businesses. They presented in the first part, a layered
architecture for the virtual business proceeding it with a conceptual architecture for a virtual
business-operating environment. In the second part, they discussed the opportunities
and research challenges in realizing the technical components of this conceptual
architecture. In last, they gave an outlook and impact of cloud services on both large and
small businesses. This work did not mention any requirements for how to proceed to
outsource BPs.
      </p>
      <p>
        According to [
        <xref ref-type="bibr" rid="ref23">23</xref>
        ], they proposed an end-to-end framework entitled Business
Process Outsourcing to the cloud (BPO2C), which covers the outsourcing process
lifecycle, from the enterprise business concerns to select the appropriate business process to
be outsourced, to a finer level of decision to select the business process fragments to be
supported by the Cloud. This framework elaborates several phases pertinent to the
outsourcing decision, starting from the elaboration of the enterprise business motivations
to identify the implied business process in the outsourcing decision, to the identification
of outsourceable process fragments to minimize the business process costs, duration
and to mitigate cloud risks.
      </p>
      <p>
        Accordingly, the work in [
        <xref ref-type="bibr" rid="ref24">24</xref>
        ] proposed an outsourcing decision method that relies
on the analytic hierarchy process (AHP) to decide whether to outsource a business
process to the Cloud or not and through which service type. The goal of this work is to
enable enterprises to understand, self-assess, select and adopt an appropriate Cloud
computing service type that is aligned to their business context. Besides the enterprise
context, they presented how the business motivation model (BMM) of the enterprise
also enhances the outsourcing decision-making by taking into account the business
plans and vision of the enterprise.
      </p>
      <p>
        The work in [
        <xref ref-type="bibr" rid="ref25">25</xref>
        ] introduced a transformation-based approach that allows companies
to control the parts of their business processes that should be allocated to their own
premises and to the Cloud, to avoid unwanted exposure of confidential data and to profit
from the high performance of the Cloud environments. They proposed in their approach
that the user annotates activities and data that should be placed into the Cloud. An
automated transformation generates the process fragments for the Cloud.
      </p>
      <p>
        Although, the proposition made in [
        <xref ref-type="bibr" rid="ref23">23</xref>
        ], [
        <xref ref-type="bibr" rid="ref24">24</xref>
        ], [
        <xref ref-type="bibr" rid="ref25">25</xref>
        ] to outsource BPs and allow
companies to benefit for, they did not consider the outsourcing of BPs in Fog computing
environment that is became as an emergent solution nowadays, especially for the field
of the Internet of Things. As well as, they did not take into consideration the
requirements as compliance, security, cost, performance and data storage for outsourcing BPs.
      </p>
      <p>Indeed, the existing solutions address the modelling of a specific-field using BPMN
as the most adequate language for modelling BPs. However, companies need a way that
helps them to recognise and control which BPs to outsource considering various and
distinct requirements. Moreover, they must have the ability to choose the appropriate
Cloud or Fog computing environment for outsourcing their BPs. To deal with, we have
proposed a BPMN extension that verifies the requirements of security, compliance,
cost, performance and data storage that enables companies basing on these
requirements to decide which provider is suitable for their BPs.
3</p>
    </sec>
    <sec id="sec-3">
      <title>Business Process Outsourcing</title>
      <p>In this section, a general overview about the outsourcing of business processes had been
presented, as well as the outsourcing towards the Cloud and Fog Computing. In the
following, the criteria that a company must consider it when outsourcing its BPs had
been discussed. Then, an extension of the domain based on BPMN Meta-model
annexed to its representation in XML schema were presented. Finally, the added graphical
elements were classified in a table with their appropriate descriptions.
3.1</p>
      <sec id="sec-3-1">
        <title>Principle of outsourcing</title>
        <p>
          In general, BPO means moving internal business processes to external service providers
to manage it based on an agreed upon service level agreements. It might be done with
one or more service provider who will execute the transferred processes based on the
client’s requirements [
          <xref ref-type="bibr" rid="ref11">11</xref>
          ]. Therefore, it implies for this purpose a closer and lasting
collaboration link between the company and the service provider.
3.2
        </p>
      </sec>
      <sec id="sec-3-2">
        <title>Outsourcing business processes to Fog/Cloud Computing</title>
        <p>The concept of Cloud Computing has made an interesting development in the field of
business process management that is especially appreciated by small and medium-sized
businesses. This latter have now access to a larger computing resources and a powerful
infrastructure that they would never have dared to afford before. However, the
explosion of data, devices, and interactions, the Cloud architecture alone cannot handle the
flow of information. Thus, its centralized resources can create delays and performance
issues for remote devices and data in a centralized public cloud (data center). Therefore,
Fog Computing is another type of solution that companies can take into consideration
to outsource their business processes by avoiding these problems. The major benefit of
this solution for businesses is that it gives a new perspective to Internet of Thing (IoT)
for real-time data processing.</p>
        <p>The IoT can be integrated into operational business processes of such companies in
order to offer a better user experience for their customers and their collaborators. In
Table 1, we present a set of differences between Cloud and Fog computing that
companies should consider it when outsourced their BPs:
Before outsourcing their business processes, companies must consider a set of criteria
to ensure that they choose the right vendors to manage their processes. The criteria that
we have considered are:
Security: Security issues are a major concern for companies that want to outsource
their business processes, because they find it very difficult to trust a third party to
manage their processes and view their data. Outsourcing business processes with its many
benefits can be a real security disaster for businesses, so companies should consider it
during the entire outsourcing process.</p>
        <p>
          Compliance: the term “Compliance” is a commonly used to refer to compliance with
a set of laws, regulations, policies or best practices. It consists of ensuring that business
processes, operations and practice comply with a set of prescribed and / or agreed
standards. Compliance requirements may come from legislatures and regulators
(SarbanesOxley, Basel II, and HIPAA), standards and codes of practice (SCOR, ISO9000) and
from business partner agreements [
          <xref ref-type="bibr" rid="ref12">12</xref>
          ]. Compliance with these different regulations can
be costly in the event that the company does not respect these rules because of the fines
imposed on them.
        </p>
        <p>Cost: Outsourcing business processes has become an easy and cost-effective technique
because it allows companies to control costs and do their jobs at a very low cost. Each
provider has its own financial offers to companies, some of which may be expensive
and others may be cheap. This is why companies must choose the provider whose offers
match their financial capabilities.</p>
        <p>Performance: Outsourcing business processes can optimize them and improve overall
performance in terms of time that is why companies should choose the best performing
services.</p>
        <p>Data Storage: Companies can outsource data storage because it is cheaper to contract
a third party than to buy and maintain their own data storage, devices and facilities.
Therefore, it becomes easy to access to this data and use it at the right time and without
restrictions. Thus, companies need to consider the data storage they need before
choosing the provider who will manage their business processes.
4</p>
      </sec>
    </sec>
    <sec id="sec-4">
      <title>BPMN extension</title>
      <p>
        Two representations for extending elements in BPMN are defined in the official
documentation of the Object Management Group (OMG) [
        <xref ref-type="bibr" rid="ref21">21</xref>
        ]:
─ The BPMN meta-model: it consists of four elements (Extension,
ExtensionDefinition, ExtensionAttributeDefinition and ExtensionAttributeValue).
─ The XML Schema representation: it specifies the interchange format for BPMN
models and support the definition of complex extensions that can be processed by
BPMN tools.
4.1
      </p>
      <sec id="sec-4-1">
        <title>BPMN extension based on a meta-model</title>
        <p>
          Business Process Model and Notation (BPMN) provides a mechanism that guarantees
the validity of BPMN basic elements and allows the integration of new domain-specific
concepts. BPMN extension is the reuse of BPMN kernel to take advantage of its
advantages and to avoid the expensive development of a domain-specific modelling
language [
          <xref ref-type="bibr" rid="ref13">13</xref>
          ].
        </p>
      </sec>
      <sec id="sec-4-2">
        <title>Meta-model for structuring BPMN elements.</title>
        <p>
          A meta-model is a formal definition of a model that helps to understand it and facilitates
reasoning about its structure, semantics, and usage [
          <xref ref-type="bibr" rid="ref14">14</xref>
          ]. BPMN describes all of its
elements in a class diagram, which is the meta-language for it [
          <xref ref-type="bibr" rid="ref15">15</xref>
          ].
        </p>
      </sec>
      <sec id="sec-4-3">
        <title>BPMN Extension for BPO.</title>
        <p>Using the meta-model of BPMN, we have proposed a BPMN extension for BPO (Fig.
1) by adding new concepts related to our domain that are the criteria discussed in
(section 3.3). Therefore, we used the element Artifacts of the BPMN meta-model to
integrate these requirements. Accordingly, the requirements of security (CIA triad:
Confidentiality, Integrity, Availability), Performance, Cost (Cost of execution, Cost of data
transfer) and Compliance were affected to Activity element while Data storage
requirement concerned Data store element. This latter is used to express the necessary data
storage that a company may need to store data during BPs execution.</p>
        <p>Fig. 1. An extended meta-model of BPMN for BPO.</p>
      </sec>
      <sec id="sec-4-4">
        <title>Representation of the extension in XML Schema format.</title>
        <p>For BPMN representation, BPMN defines a set of XML schema documents specifying
the interchange format for BPMN models. Thus, to model and exchange BPMN models
that include state transitions and nodes, we derive an XML schema for our extension:
&lt;? XML version= "1.0" encoding="UTF-8”?&gt;
&lt;xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
&lt;xsd:element name=" BPOcritaria” type=" BPOcritaria Type"/&gt;
&lt;xsd:complexType name=" BPOcritaria Type"&gt;
&lt;xsd:all&gt; &lt;xsd:element name=”Security” minOccurs=”0 ”&gt;
&lt;xsd:complexType&gt; &lt;xsd:sequence&gt; &lt;xsd:restriction base=”xsd:string”&gt;
&lt;xsd:enumeration value=”Availability”/&gt; &lt;xsd:enumeration value=”Confidentiality”/&gt;
&lt;xsd:enumeration value=”Integrity”/&gt;
&lt;/xsd:restriction&gt; &lt;/xsd:sequence&gt;&lt;/xsd:complexType&gt;&lt;/xsd:element&gt;
&lt;xsd:element name=”Compliance” minOccurs=”0”&gt;
&lt;xsd:complexType&gt; &lt;xsd:sequence&gt;
&lt;xsd:element name=”rule” type=”xsd:string” maxOccurs=”unbounded”/&gt;
&lt;xsd:element name=”standard” type=”xsd:string” maxOccurs=”unbounded”/&gt;
&lt;/xsd:sequence&gt;&lt;/xsd:complexType&gt;&lt;/xsd:element&gt;
&lt;xsd:element name=”Cost” minOccurs=”0”&gt;
&lt;xsd:complexType&gt; &lt;xsd:sequence&gt; &lt;xsd:restriction base=”xsd:string”&gt;
&lt;xsd:enumeration value=”Cost of execution”/&gt;&lt;xsd:enumeration value=”Cost of data transfer”/&gt;
&lt;/xsd:restriction&gt;&lt;/xsd:sequence&gt;&lt;xsd:simpleContent&gt;
&lt;xsd:extensionbase=”xsd:decimal”&gt;
&lt;xsd:attribute name=”money” type=”xsd:string” use=”required” /&gt;
&lt;/xsd: extension&gt;&lt;/xsd: simpleContent&gt;&lt;/xsd: complexType&gt;&lt;/xsd: element&gt;
&lt;xsd:element name=”Performance” type=”xsd:duration” minOccurs=”0” /&gt;
&lt;xsd:element name=”Data storage” type=” xsd: decimal” minOccurs=”0” /&gt;&lt;/xsd:all&gt;</p>
      </sec>
      <sec id="sec-4-5">
        <title>The graphical elements added in the extension.</title>
        <p>The BPMN specification provides no graphical notation for the representation of
extensions. However, new graphical shapes can be added as artifacts. Thus, a set of
graphic elements to annotate the activities of BPs are proposed, as well as for the data
store. In table 2, the graphical representation of the proposed extension on the Activity
and Data store elements of BPMN meta-model followed by their descriptions are
presented.</p>
        <sec id="sec-4-5-1">
          <title>This element is used when the activity en</title>
          <p>sures that only authorized entities have
access to resources.</p>
          <p>This element is used when the activity
ensures that the data has not been tampered
with/or destroyed in an unauthorized
manner.</p>
          <p>This element is used when the activity
ensures that access to resources is possible
when needed, and that resources are not
uselessly occupied.</p>
          <p>This element indicates that the activity
must comply with the rules and / or
standards.</p>
          <p>This element indicates the cost of carrying
out an activity; the red, yellow and green
colours represent the activities that require
a high, medium and low execution cost,
respectively.</p>
          <p>This element is used to indicate that an
activity requires some cost to transfer its data
to another activity.</p>
        </sec>
        <sec id="sec-4-5-2">
          <title>This element is added when the activity requires a lot of performance to work efficiently and to respect the temporal constraints.</title>
          <p>This element is added when data storage
occurs while performing an activity.
Alphabets H and L represent Huge and Lower
data storage, respectively.</p>
        </sec>
      </sec>
    </sec>
    <sec id="sec-5">
      <title>Use case</title>
      <p>
        For organizations that want to increase productivity by improving business process
management, a superior Business Process Management System (BPMS) is required.
BPMS provides a suite of tools that gives organizations the ability to design, test, and
implement automated business processes by facilitating the efficient simulation of the
life cycle of a business process for a very precise implementation [
        <xref ref-type="bibr" rid="ref16">16</xref>
        ]. In this section,
the BPMN extension for BPO has been demonstrated through an illustrative example
followed by a set of BPM tools that allow implementing it.
5.1
      </p>
      <sec id="sec-5-1">
        <title>Illustrative example of the telemedicine system</title>
      </sec>
      <sec id="sec-5-2">
        <title>What is telemedicine?</title>
        <p>
          Telemedicine (healing at a distance), signifies the use of information and
communication technologies (ICT) to improve patient outcomes by increasing access to care and
medical information [
          <xref ref-type="bibr" rid="ref17">17</xref>
          ]. In our example, the telemedicine system consists of the
following actors:
─ Patient: represents the person who needs health care.
─ Server: represents the intermediary between patient and doctor and it processes the
patient's data.
─ Doctor: A medical expert who communicates with the patient and receives
information about the patient in order to give him a solution to his health problem.
─ Medical device: Any device, equipment or material used alone or in combination
with humans for the treatment of a disease.
        </p>
      </sec>
      <sec id="sec-5-3">
        <title>Representation of the process using the BPO extension.</title>
        <p>In Fig. 3, an extended version of the telemedicine process using the proposed elements
has been illustrated to represent BP requirements for outsourcing into the Cloud and
Fog computing environments, which are Security, Compliance, Cost, Performance and
Data storage. Associating with each activity the requirements that it may need during
its execution.</p>
      </sec>
      <sec id="sec-5-4">
        <title>Discussion on the outsourcing of the process.</title>
        <p>Using the BPO extension, we can classify the activities in the example (Fig. 3)
according to the provider that suits them Cloud or Fog Computing:
─ Pay: The appropriate provider for this activity is Fog Computing, as it must comply
with the PCI-DSS standard that protects the patient's bank account to prevent
fraudulent use because of privacy.
─ Verify Account: The environment for this activity is Fog Computing because it
must comply with the IAS ECC standard by the use of a professional health card
(CPS) that guarantees a high level of system security.
─ Receiving data: The appropriate environment for this activity is Fog Computing
because this activity requires high-level of security and must comply with the
HIPAA standard that protects patient’s data.
─ Treat data: We can migrate this activity to Cloud computing because it requires a
great performance.
─ Read Feedback: The appropriate environment is Fog Computing because it requires
security (Availability and Integrity), the purpose of which is to prevent the
unauthorized use, alteration, or misuse of patient’s data and guarantees access to the patient’s
information when it needs.
─ Send demand, Consult patient's situation, Send medical order, Receive medical
order and Apply appropriate care: These activities remain in the company to
avoid outsourcing its key operation aspects because they represent the heart of the
business.</p>
      </sec>
    </sec>
    <sec id="sec-6">
      <title>Implementation</title>
      <p>
        Several BPM tools are used to model extensions, the proposed extension had been
implemented by using three tools, which are Bizagi Process Modeler, Gliffy Diagram and
yEd Graph Editor. Each tool gives the ability to add new Artifacts for the proposed
extension that are Security, Compliance, Cost, Performance and Data storage without
changing the shape of existing elements. In this section, tools that were extended to
allow the use of the proposed extension are presented as follow:
1. Bizagi Process Modeler is an application for modelling and documenting business
processes. The tool allows us to visually map, model and document business
processes in the Business Process Model Notation (BPMN) standard [
        <xref ref-type="bibr" rid="ref26">26</xref>
        ] (Fig. 4):
2. yEd Graph Editor: is a powerful desktop application that can be used to quickly
and efficiently generate high quality diagrams [
        <xref ref-type="bibr" rid="ref27">27</xref>
        ] (Fig 5):
      </p>
      <p>Fig. 5. yEd Graph Editor Diagram.
3. Gliffy Diagram: is a diagram software through a cloud-based HTML5 application.</p>
      <p>
        It is used to create UML diagrams, floor plans, Venn diagrams, flow charts and
various other types of online diagrams [
        <xref ref-type="bibr" rid="ref28">28</xref>
        ] (Fig. 6.).
      </p>
    </sec>
    <sec id="sec-7">
      <title>3. Conclusion</title>
      <p>
        Business Process Outsourcing is a medium-term strategic approach for companies to
maintain a high level of performance, a lower operating cost, focus on the core business
and flexibility. However, outsourcing is not a decision to take lightly; it requires careful
thought and management as a mistake in this area can be costly both financially and
humanly and it is very difficult to reverse. The difficulty of outsourcing management
is related mainly to the difficulty of choosing the ideal provider for the required service
Cloud or Fog computing. On the other hand, we argue that the model is not universally
applicable, and that emergent IoT applications demand a platform with novel
characteristics as Fog computing [
        <xref ref-type="bibr" rid="ref3">3</xref>
        ].
      </p>
      <p>In this paper, it was proposed an extension of the BPMN language considering our
main objective was to improve and assist companies for a better decision in outsourcing
the adequate BPs. The requirements of BPs activities of this latter were specified
according to several criteria that are Security, Performance, Compliance, Cost and Data
storage. Our extension was developed using two representations provided by the BPMN
extension mechanism that are the BPMN meta-model and the XML Schema. We
completed the model by adding new graphical elements into a modelling tool. Finally, we
chose the telemedicine system to explain our proposed extension and to express its
decision-making role in choosing the right provider.</p>
      <p>As a complement to this work, we wish to apply our approach in the field of the
Internet of Things, based on the criteria presented in our BPMN extension to facilitate
the selection of the best provider (Cloud or Fog computing). We wish also to compare
the suppliers Cloud or Fog once the adapted environment is determined .Thus, we aim
to consider other criteria for outsourcing BPs besides the criteria presented in our paper
and we discuss the case of changes in processes requirements. Finally, we look at
whether there is a possibility to extend other tools.</p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1.
          <string-name>
            <surname>Mell</surname>
            ,
            <given-names>P.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Grance</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          :
          <article-title>The NIST definition of cloud computing</article-title>
          . (
          <year>2011</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          2.
          <string-name>
            <surname>Stojmenovic</surname>
            ,
            <given-names>I.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Wen</surname>
            ,
            <given-names>S.:</given-names>
          </string-name>
          <article-title>The Fog-computing paradigm: Scenarios and security issues</article-title>
          .
          <source>In Computer Science and Information Systems (FedCSIS)</source>
          ,
          <source>Federated Conference</source>
          <year>2014</year>
          , pp.
          <fpage>1</fpage>
          -
          <lpage>8</lpage>
          . IEEE. (
          <year>2014</year>
          , September).
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          3.
          <string-name>
            <surname>Bonomi</surname>
            ,
            <given-names>F.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Milito</surname>
            ,
            <given-names>R.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Natarajan</surname>
            ,
            <given-names>P.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Zhu</surname>
          </string-name>
          , J.:
          <article-title>Fog computing: A platform for internet of things and analytics. In Big data and internet of things: A roadmap for smart environments 2014</article-title>
          , pp.
          <fpage>169</fpage>
          -
          <lpage>186</lpage>
          . Springer, Cham (
          <year>2014</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          4.
          <string-name>
            <surname>INFSO</surname>
          </string-name>
          , D.:
          <article-title>Networked Enterprise &amp; RFID INFSO G. 2 Micro &amp; Nanosystems, in co-operation with the Working Group RFID of the ETP EPOSS, Internet of Things in 2020, Roadmap for the Future</article-title>
          [R].
          <source>Information Society and Media, Tech. Rep</source>
          (
          <year>2008</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          5.
          <string-name>
            <surname>Bandyopadhyay</surname>
            ,
            <given-names>D.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Sen</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          :
          <article-title>Internet of things: Applications and challenges in technology and standardization</article-title>
          .
          <source>Wireless Personal Communications</source>
          ,
          <volume>58</volume>
          (
          <issue>1</issue>
          ),
          <fpage>49</fpage>
          -
          <lpage>69</lpage>
          . (
          <year>2011</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          6.
          <string-name>
            <surname>Corbett</surname>
            ,
            <given-names>M.:</given-names>
          </string-name>
          <article-title>The outsourcing revolution: Why it makes sense and how to do it right</article-title>
          .
          <source>Dearborn Trade Publishing</source>
          (
          <year>2004</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          7.
          <string-name>
            <surname>Wohed</surname>
            , P., van der Aalst,
            <given-names>W. M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Dumas</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>ter Hofstede</surname>
            ,
            <given-names>A. H.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Russell</surname>
          </string-name>
          , N.:
          <article-title>On the suitability of BPMN for business process modelling</article-title>
          .
          <source>In International conference on business process management</source>
          <year>2006</year>
          , pp.
          <fpage>161</fpage>
          -
          <lpage>176</lpage>
          . Springer, Berlin, Heidelberg. (
          <year>2006</year>
          , September).
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          8.
          <string-name>
            <surname>Rodríguez</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Fernández-Medina</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Piattini</surname>
            ,
            <given-names>M.:</given-names>
          </string-name>
          <article-title>A BPMN extension for the modeling of security requirements in business processes</article-title>
          .
          <source>IEICE transactions on information and systems</source>
          ,
          <volume>90</volume>
          (
          <issue>4</issue>
          ),
          <fpage>745</fpage>
          -
          <lpage>752</lpage>
          . (
          <year>2007</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>
          9.
          <string-name>
            <surname>Lodhi</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Küppen</surname>
            ,
            <given-names>V.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Saake</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          :
          <article-title>An extension of bpmn meta-model for evaluation of business processes</article-title>
          .
          <source>Scientific Journal of Riga</source>
          Technical University. Computer Sciences,
          <volume>43</volume>
          (
          <issue>1</issue>
          ),
          <fpage>27</fpage>
          -
          <lpage>34</lpage>
          . (
          <year>2011</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref10">
        <mixed-citation>
          10.
          <string-name>
            <surname>Graja</surname>
            ,
            <given-names>I.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Kallel</surname>
            ,
            <given-names>S.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Guermouche</surname>
            ,
            <given-names>N.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Kacem</surname>
            ,
            <given-names>A. H.:</given-names>
          </string-name>
          <article-title>BPMN4CPS: A BPMN extension for modeling cyber-physical systems</article-title>
          . In Enabling Technologies:
          <article-title>Infrastructure for Collaborative Enterprises (WETICE</article-title>
          ),
          <year>2016</year>
          IEEE 25th International Conference on, pp.
          <fpage>152</fpage>
          -
          <lpage>157</lpage>
          . IEEE (
          <year>2016</year>
          , June).
        </mixed-citation>
      </ref>
      <ref id="ref11">
        <mixed-citation>
          11.
          <string-name>
            <surname>Ibrahim</surname>
            ,
            <given-names>S. E.</given-names>
          </string-name>
          :
          <article-title>Business Process Outsourcing; Performance Measurement for Call Center Services</article-title>
          .
        </mixed-citation>
      </ref>
      <ref id="ref12">
        <mixed-citation>
          12.
          <string-name>
            <surname>Sadiq</surname>
            ,
            <given-names>S.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Governatori</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Namiri</surname>
            ,
            <given-names>K.</given-names>
          </string-name>
          :
          <article-title>Modeling control objectives for business process compliance</article-title>
          .
          <source>In International conference on business process management</source>
          (pp.
          <volume>14</volume>
          <fpage>9</fpage>
          -
          <lpage>164</lpage>
          ). Springer, Berlin, Heidelberg. (
          <year>2007</year>
          , September).
        </mixed-citation>
      </ref>
      <ref id="ref13">
        <mixed-citation>
          13.
          <string-name>
            <surname>Braun</surname>
            ,
            <given-names>R.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Schlieter</surname>
            ,
            <given-names>H.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Burwitz</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Esswein</surname>
            ,
            <given-names>W.:</given-names>
          </string-name>
          <article-title>BPMN4CP: Design and implementation of a BPMN extension for clinical pathways</article-title>
          .
          <source>In Bioinformatics and Biomedicine (BIBM)</source>
          ,
          <source>2014 IEEE International Conference</source>
          , pp.
          <fpage>9</fpage>
          -
          <lpage>16</lpage>
          . IEEE (
          <year>2014</year>
          , November).
        </mixed-citation>
      </ref>
      <ref id="ref14">
        <mixed-citation>
          14.
          <string-name>
            <surname>Mallouli</surname>
            ,
            <given-names>S. D.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Assar</surname>
            ,
            <given-names>S.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Souveyet</surname>
            ,
            <given-names>C.</given-names>
          </string-name>
          :
          <article-title>Pour une perspective comportementale dans les méta-modèles de processus. In XXIXème Congrès INFORSID (Informatique des Organisations et Systèmes d</article-title>
          'Information et de Décision).
          <source>(</source>
          <year>2011</year>
          , May).
        </mixed-citation>
      </ref>
      <ref id="ref15">
        <mixed-citation>
          15.
          <string-name>
            <surname>Dörndorfer</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Seel</surname>
            ,
            <given-names>C.</given-names>
          </string-name>
          :
          <article-title>A Meta model based extension of BPMN 2.0 for mobile context sensitive business processes and applications</article-title>
          . (
          <year>2017</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref16">
        <mixed-citation>16. Business Process Management Software, https://www.capterra.com/business-processmanagement-software/</mixed-citation>
      </ref>
      <ref id="ref17">
        <mixed-citation>
          17.
          <string-name>
            <surname>Telemedicine</surname>
          </string-name>
          <article-title>: opportunities and</article-title>
          developments in
          <source>Member States: report on the second global survey on reHealth</source>
          <year>2009</year>
          .
          <article-title>(Global Observatory for</article-title>
          eHealth Series, 2)
        </mixed-citation>
      </ref>
      <ref id="ref18">
        <mixed-citation>
          18.
          <string-name>
            <surname>Hassen</surname>
            ,
            <given-names>Mariam</given-names>
          </string-name>
          <string-name>
            <surname>Ben</surname>
          </string-name>
          , et al.
          <article-title>"BPMN4KM: Design and Implementation of a BPMN Extension for Modeling the Knowledge Perspective of Sensitive Business Processes."</article-title>
          <source>Procedia Computer Science</source>
          <volume>121</volume>
          (
          <year>2017</year>
          ):
          <fpage>1119</fpage>
          -
          <lpage>1134</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref19">
        <mixed-citation>
          19.
          <string-name>
            <surname>Weske</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          :
          <article-title>Business process management architectures</article-title>
          .
          <source>In Business Process Management</source>
          , pp.
          <fpage>333</fpage>
          -
          <lpage>371</lpage>
          . Springer, Berlin, Heidelberg. (
          <year>2012</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref20">
        <mixed-citation>
          20.
          <string-name>
            <surname>Braun</surname>
            ,
            <given-names>R.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Esswein</surname>
            ,
            <given-names>W.</given-names>
          </string-name>
          :
          <article-title>Classification of domain-specific BPMN extensions</article-title>
          .
          <source>IFIP Working Conference on IFIP Working Conference on the Practice of Enterprise Modeling</source>
          . Springer, Berlin, Heidelberg,
          <year>2014</year>
          . p.
          <fpage>42</fpage>
          -
          <lpage>57</lpage>
          (
          <year>2014</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref21">
        <mixed-citation>
          21.
          <string-name>
            <surname>Object Management</surname>
          </string-name>
          <article-title>Group (OMG) 'Business Process Model and Notation (BPMN) Version 2</article-title>
          .0.2' [online] http://www.omg.org/spec/BPMN/2.0.2/. (
          <year>2013</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref22">
        <mixed-citation>
          22.
          <string-name>
            <surname>Motahari-Nezhad</surname>
            ,
            <given-names>H. R.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Stephenson</surname>
            ,
            <given-names>B.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Singhal</surname>
            ,
            <given-names>S.</given-names>
          </string-name>
          :
          <article-title>Outsourcing business to cloud computing services: Opportunities and challenges</article-title>
          .
          <source>IEEE Internet Computing</source>
          ,
          <year>2009</year>
          , vol.
          <volume>10</volume>
          , no 4, p.
          <fpage>1</fpage>
          -
          <lpage>17</lpage>
          . (
          <year>2009</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref23">
        <mixed-citation>
          23.
          <string-name>
            <surname>Rekik</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Boukadi</surname>
            ,
            <given-names>K.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Ben-Abdallah</surname>
          </string-name>
          , H.:
          <article-title>A comprehensive framework for business process outsourcing to the cloud</article-title>
          .
          <source>In: Services Computing (SCC)</source>
          ,
          <source>2016 IEEE International Conference on. IEEE</source>
          ,
          <year>2016</year>
          . p.
          <fpage>179</fpage>
          -
          <lpage>186</lpage>
          . (
          <year>2016</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref24">
        <mixed-citation>
          24.
          <string-name>
            <surname>Rekik</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Boukadi</surname>
            ,
            <given-names>K.</given-names>
          </string-name>
          , &amp;
          <string-name>
            <surname>Ben-Abdallah</surname>
          </string-name>
          , H.:
          <article-title>A decision-making method for business process outsourcing to the cloud based on business motivation model and AHP</article-title>
          .
          <source>International Journal of Cloud Computing 2</source>
          ,
          <year>2015</year>
          , vol.
          <volume>4</volume>
          , no 1, p.
          <fpage>47</fpage>
          -
          <lpage>62</lpage>
          . (
          <year>2015</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref25">
        <mixed-citation>
          25.
          <string-name>
            <surname>Duipmans</surname>
          </string-name>
          , Evert Ferdinand,
          <article-title>Luís Ferreira Pires, and Luiz Olavo Bonino da Silva Santos: A transformation-based approach to business process management in the cloud</article-title>
          .
          <source>Journal of grid computing</source>
          ,
          <year>2014</year>
          , vol.
          <volume>12</volume>
          , no 2, p.
          <fpage>191</fpage>
          -
          <lpage>219</lpage>
          (
          <year>2014</year>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref26">
        <mixed-citation>26. https://www.bizagi.com/</mixed-citation>
      </ref>
      <ref id="ref27">
        <mixed-citation>27. https://www.yworks.com/products/yed/release-notes</mixed-citation>
      </ref>
      <ref id="ref28">
        <mixed-citation>28. https://www.gliffy.com/</mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>