This paper proposes an approach to the organization of a decentralized business process model repository to provide a secure and stable software solution for keeping and accessing business process model collections. State-of-the-art studies consider the problem of managing large collections of business process models as an extremely complex challenge, whereas the security and integrity of such corporate knowledge assets are crucial features of repository software. Today blockchain technologies are used not only as ledgers of financial transactions, but also as general-purpose distributed databases that provide high-level security, integrity, and availability. Thus, organizations may benefit from using blockchain platforms and knowledgesharing protocols built on top of them. Therefore, in this paper, we consider the problem of decentralized blockchain-based business process model repository development using smart contract and decentralized application technologies. Presented software prototype of limited functionality is developed on top of the Ethereum test network, accessible using the single page Web3 application. Developed software prototype is validated, obtained results are discussed, the conclusion is made, and the future work is formulated.
The current trend of the digital transformation encourages large enterprises, medium-sized companies, and even small businesses to focus on detection, analysis, and improvement of their business processes by deploying BPM (Business Process Management) suites that automate routine activities. Such an approach is known as BPM, while described cycle of continuous process improvement is referred to as BPM lifecycle. Business processes are considered as structured sequences of activities performed by employees and other stakeholders to transform raw information or materials into products or services valuable for customers, either external or internal. For example, a sick leave application is processed to satisfy an internal customer – an employee who requested the sick leave, while order processing serves an external customer – a company’s client or a counter-party organization, which requires order fulfillment. Each of such business scenarios is called a business process and, traditionally for BPM projects, is represented using graphical models (similar to flowcharts used to describe algorithms) to capture, store, and share knowledge about organizational activities. Captured knowledge about ongoing business processes represented in the form of graphical schemes could be used to train new employees (future process participants) or to detect inefficiencies in workflows to improve organizational activities through business process automation (replacing manual routine tasks with scripts) or re-engineering (rebuilding whole business process scenarios from scratch).
Thus, it is natural for big enterprises to have extremely large collections of hundreds or even thousand [1] of business process models. Keeping and accessing such volumes of business process models could be possible with the use of enterprise-level techniques and software solutions. Since availability, integrity, and security are crucial features for enterprise collections of business process
2022 Copyright for this paper by its authors. models, in this paper we consider the usage of blockchain technology to keep and manage business process models securely and stably. The research subject is the collection of business process models organized using blockchain technology. The research objective includes an approach to managing the blockchain-based storage of business process models.
This paper is structured in the following way: current section outlines the introduction, as well as the state-of-the-art overview (sub-section 1.1) and problem statement (sub-section 1.2); section 2 demonstrates an approach to the organization of a blockchain-based collection of business process models, while Section 3 introduces developed software solution together with a discussion of its usage results; Section 4 contains conclusion and planned directions of future research in this field. 1.1.
According to Yan et al. [1], managing enormous collections of business process models is a complex
problem indeed, which requires special software tools to store, search, and manage business process
model versions [1]. Such software was called a “business process model repository” [1] and, according
to Elias [2], it should correspond to particular requirements, e.g. support of a standard business process
modeling notation BPMN (Business Process Model and Notation) [3], displaying of both graphical and
textual process descriptions, provision of multiple model versions for the same process, model search
and categorization, model analysis and comparison, support of relationships between business process
models, etc. However, there are external access and security [2] requirements, which fulfillment is
critical for corporate assets. Access control and integrity control features were also mentioned by La
Rosa et al. [4], as capabilities of an advanced business process model repository software named
“APROMORE” [4]. Also, access, integrity, and, in addition, transaction management features were
mentioned as part of the framework for business process model repositories proposed by Yan and
Grefen [
First studies in this direction were published in [
Shared business process modeling and versioning rather than execution was proposed by Härer [
Another paper focused on blockchain-based business process management considers
crossorganizational business processes, which include collaborative activities distributed among businesses
and individuals, based on blockchain technology [
Since the crypto-boom of 2017, blockchain technology went far beyond the Bitcoin cryptocurrency,
even though it was initially designed to fit digital currency requirements, such as forgery resistance,
immutability, and decentralized community-backed governance [
Such benefits could not be unnoticed by industry and to support business process execution on top
of blockchains, “smart contracts” were introduced as the computer programs that run in the blockchain
platform and record results of their execution as an immutable transaction into the blockchain [
DApps use smart contracts as back-end code and blockchains as databases in contrast to traditional
applications backed by centralized servers, whereas the frontend of DApps is usually created with the
traditional combination of HTML (HyperText Markup Language), CSS (Cascading Style Sheets), and
JavaScript together with the “web3.js” library is used to access Ethereum API (Application
Programming Interface) [
Considering the relatively young age of blockchain-based business process management, there are
mostly proof-of-concept or experimental solutions currently existing (i.e. Caterpillar and others [
According to the conceptual model shown in Figure 1, a blockchain-based repository of BPMN models could be implemented as multiple smart contracts: a main smart contract, which addresses one or several smart contracts that represent collections of business process models. As the frontend should be created a decentralized web application that will get the registry of process model collection from the main smart contract and access respective collections of BPMN models. Therefore, such a repository may contain multiple business process models collections owned by different organizations or individuals supporting this enterprise knowledge sharing initiative.
Financial capabilities of modern blockchain platforms (i.e. cryptocurrencies and custom tokens) could be used in the repository to exchange BPMN models of best-practice business processes on a commercial basis (e.g. access to certain collections could be granted as per subscription or one-time purchase). However, the initial goal is to define the generic structure and behavior of a business process model collection built on top of a blockchain platform. Then, a proof-of-concept smart contract and corresponding DApp should be implemented, e.g. using the Ethereum platform as the most popular one.
Business process model collection built on top of a certain blockchain platform could be described using the following formal definitions.
Collection of business process models is the set of documents prepared in BPMN 2.0 format (XMLbased files), which represent organizational activities for knowledge gathering and sharing purposes. It could be formally described using the following tuple:
C own, MR, m, P, A . where: ─ own is the owner of a collection of business process models (in blockchain platforms it could be defined by the address, e.g. as the hexadecimal string); ─ MR is the list of records about business process models associated with this collection; ─ m is the number of business process model records in the list MR (i.e. how many business process models are referenced in this collection); ─ P is the permissions mapping, which defines users allowed to access this collection (in blockchain platforms users also could be defined by their addresses, as well as the collection owner own ); ─ A is the set of algorithms used to manage a collection of business process models.
Business process model record is the structure that consists of business process model attributes, which could be described using the following tuple: (1) where: ─ t i is the title of a business process model referenced in this record; ─ ui is the direct URL (Uniform Resource Locator) used to access a BPMN 2.0 document that corresponds to a referenced business process model; ─ hi is the hash value of a BPMN 2.0 content (XML-based file) that describes a business process (that could be calculated using secure hash algorithms, i.e. SHA256 or SHA512, or others); hash value is used to check the authenticity of a business process model referenced in a collection; ─ desci is the annotation or brief description of a business process model referenced in this record; ─ ind i is the industry name to which a business process described by a referenced in this record model belongs; ─ ts i is the timestamp that shows when this record about a business process model was made to the blockchain.
In fact, according to the proposed approach business process models are stored elsewhere (e.g. on
shared file servers or version control system servers that support collaborative work, such as GitHub or
GitLab), while only URLs and hash values of BPMN models are stored in the blockchain. This method
is the most efficient: it saves a huge amount of space and cost, while making a collection
tampertraceable [
Permissions mapping is the function that associates each address of a blockchain network to the binary value, which determines whether such address is allowed to add new business process models into this collection (1) or not:
P : addr {0,1}, addr Addr. where: ─ addr is the address in a blockchain network, which belongs to a set of all addresses in the network addr Addr ; for the owner’s address P(own) 1, own Addr ; ─ values of the codomain {0,1} of P determine whether a user with network address addr is allowed to add new business process models to a collection, P(addr) 1, or not P(addr) 0 .
Besides the owner’s address own Addr , P(own) 1 , by default for all of the addresses existing in a blockchain network P(addr) 0 , addr Addr , unless another is given using one of the algorithms for managing a collection of business process models.
Algorithms to manage a collection of business process models is the set of algorithms used to implement certain operations with the collection of business process models, including adding the reference to a BPMN model and setting access permissions. In general, such algorithms could be represented as the following tuple:
A add, set . where: ─ add is the algorithm of adding new record about a business process model referenced (2) in this collection (1); ─ set is the algorithm of setting access permissions (either granting or revoking) for a given user’s address (3). (2) (3) (4)
Considered algorithms (4) used to manage the collection of business process models will be described in detail in further subsection.
In the subsection will be outlined in details algorithms (4) for managing the collection of business process models (1). Each of algorithms add and set are given below.
It is denoted as add (4) and takes as input: ─ title of a referenced business process model, tnew ; ─ direct URL link to access a BPMN 2.0 document, u new ; ─ hash value of a BPMN 2.0 file used to check the authenticity of a referenced business process model, hnew ; ─ annotation or brief description of a referenced business process model, desci ; ─ industry name to which a described business process belongs, ind i ; ─ timestamp that shows when a referenced business process model was added, tsi .
This algorithm add consists of following steps:
Step 1. Get the sender’s address (i.e. a blockchain address of a user who initiated the execution of this algorithm) send Addr .
Step 2. Determine the access permission P(send) given to the obtained sender’s address send Addr . Check whether the sender’s address is given with the permission (3) to access a collection of business process models, i.e. if P(send) 1, send Addr , then proceed to Step 3. Otherwise, if P(send) 0 , execution of the algorithm should be finished.
Step 3. Create a new record about a business process model that should be added to the blockchain MRnew tnew , unew , hnew , descnew , indnew , tsnew , where new m 1.
Step 4. Add created record MRnew to the end of the list of business model records MR (2). Step 5. Increase the number of business process model records, m m 1. Finish the algorithm.
The sender’s address send Addr could be obtained from a transaction fired by a certain blockchain platform user. According to the outlined algorithm, only the collection’s owner own Addr should be capable of adding new business process model references.
Later, when making collections of business process models accessible on a commercial basis, the proposed algorithm could be modified to allow non-owners to publish their models into collections for rewards in native repository tokens (quasi-cryptocurrency) that could be then spent to access private business process model collections.
It is denoted as set (4) and takes as input: ─ user’s address in a blockchain platform, user Addr ; ─ access granting or revoking value – 0 or 1 (in the smart contract implementation we may use “true” or “false” Boolean constants), access .
This algorithm set consists of following steps: Step 1. Get the sender’s address send Addr .
Step 2. Compare obtained sender’s address send Addr to the collection owner’s address own Addr . If compared addresses are equal, then proceed to Step 3 and finish.
Step 3. Compare the user’s address user Addr to the collection owner’s address own Addr . If compared addresses are not equal, then proceed to Step 4 and finish.
Step 4. Set access permission for the given user, P(user) access, user Addr .
According to the outlined algorithm, only the collection’s owner own Addr should be capable of setting access permissions. Moreover, the owner cannot manage its own access permission, i.e. user own condition should be met.
We have selected the Ethereum blockchain platform for smart contract implementation because of
its dominance in the area [
In terms of a UML (Unified Modeling Language) class diagram notation, the static structure of a developed smart contract prototype could be shown as follows (see Figure 2).
This “ModelsCollection” smart contract contains several private fields, which correspond to definition (1): “Owner” is the address of a user who deployed this contract to the blockchain; “Models” is the array of business process model records described by the respective structure “ModelRecord” concerning definition (2); “ModelsCount” is the number of referenced business process models and increments when a new model is recorded to the collection; “Permissions” is the mapping between user addresses and given or revoked permissions, according to definition (3).
Methods of the smart contract correspond to the algorithms defined in (4). Besides the constructor, which initializes the “Owner” field and grants permissions to the owner respectively, the remaining methods implement considered algorithms: “AddModel” takes input parameters that describe a BPMN model and makes a record to the array “Models” (according to Fig. 2); “ReadModels” checks permissions of a user who called this method and returns collection of recorded business process model references (according to Fig. 3); “SetPermission” allows the owner to grant or revoke access permissions to or from the mentioned user address (according to Fig. 4). “CheckPermission” allows any user to check their permissions.
The source code of the developed smart contract is available at [
Created web application prototype shows a decentralized application that uses HTML, CSS, and
JavaScript together with the “web3.js” library to work with the smart contract demonstrated in the
previous sub-section. Its source code is available at [
The system architecture of the proposed solution could be demonstrated using the UML deployment diagram (see Figure 3).
When users try to access the business process model collection provided by the smart contract, their Ethereum addresses are taken from the MetaMask (users should be preliminarily authorized and connected) or another wallet, access permissions are checked, and the list of reference BPMN models is displayed using the web page (see Figure 4).
All of these procedures are implemented as the JavaScript code powered by web3.js and jQuery and libraries to read the smart contract and show results respectively. In order to check the authenticity of a business process model (whether it was altered), the CryptoJS library is used to calculate the SHA256 hash value of a BPMN document requested using the stored link, which is then compared to the model’s hash value stored in the blockchain. Model’s authenticity could be checked when accessing the collection through a web application (see Figure 4).
As it is shown in Fig. 8, a business process model could be downloaded as the BPMN file for its
further usage. For now, this is all functionality of the prototype DApp created to work with the
collection of business process models implemented using the Ethereum smart contract. When the owner
needs to add new models to the collection, add, or change given user permissions, the smart contract
could be used directly from the network explorer in the reading or writing modes [
To validate the developed software prototype we used a BPMN model of the “Dispatch of goods”
business process from [
This model was added to the collection by contract’s owner, whose Ethereum wallet address is: ─ “0xC0753Fff03d88B34B9538d0A93D64831EE85d95C”.
The “Dispatch of goods” model was published by calling the “AddModel” method, corresponding transaction details are shown in Figure 5.
This transaction has the following ID, which can be used to check it in the Ropsten Etherscan:
Let us consider a case when a business process model [
As it is shown in Figure 6, the recently added business process model (see Figure 5) was accompanied by the wrong hash value, so the DApp displays it as tampered. The problem is that the given hash value does not equal the calculated SHA256 value:
Then let us grant user “0x1E8d4Bdd6209Ebfd51aBbfcA12d9050E04A27adD” with the publishing permission by using the “SetPermission” method (see Figure 7).
This transaction has the following ID, which can be used to check it in the Ropsten Etherscan:
Publishing new records about business process models now is accessible not only to the owner but also to the “0x1E8d4Bdd6209Ebfd51aBbfcA12d9050E04A27adD” user account.
When a user, who does not have permission, tries to publish a new business process model to the collection, e.g. with “0x272B70999A9aFbF471Ce697D7610AC091C0be962” account, the following result is obtained (see Figure 8).
This transaction has the following ID, which can be used to check it in the Ropsten Etherscan:
All of the considered transactions can be seen on the smart contract page (see Fig. 9) [
In this study, we proposed the approach to the organization of a decentralized blockchain-based business process model repository that could be used to provide a secure software solution to store and access the business process model collection in a tamper-resistant manner.
A review of the state-of-the-art has shown the complexity of the problem of managing large collections of business process models since the security and integrity of these enterprise knowledge assets are vital characteristics of the repository software intended to manage large business process model collections. There were covered multiple existing solutions in the domain of blockchain-based business process management, including decentralized systems for business process execution and cross-organizational collaboration. However, inter-organizational blockchain-backed solutions, intended to keep and share business process knowledge, have not been elaborated yet. As the result of blockchain platforms overview considering their smart contracts programming capabilities, was chosen the Ethereum platform was the pioneer and leader in the field of decentralized applications. Finally, there was proposed a conceptual model of a business process model repository based on blockchain technology.
The proposed approach is based on several formal definitions given to elaborate the domain of blockchain-based business process model collections. There were given definitions of the collection of business process models, the business process model record, the permissions mapping, and the collection management algorithms. These algorithms are used to add a new record about a business process model and configure access permissions. Formal definitions and algorithms were implemented as the smart contract prototype deployed to the Ethereum test network Ropsten. Also, there was created the prototype of a web application to access the smart contract.
Future work includes the elaboration of exchanging and trading capabilities of the proposed solution. Also, we plan to consider the non-fungible token (NFT) standard for storing and exchanging business models over the inter-organizational blockchain in a standardized and unified manner.
[1] Yan, Z., Dijkman, R., Grefen, P., Business process model repositories–Framework and survey.
Information and software technology 54(4) (2012) 380–395. [2] Elias, M., Design of business process model repositories: requirements, semantic annotation model and relationship meta-model. Stockholm University, 2015. [3] About the Business Process Model and Notation Specification Version 2.0.2. URL: https://www.omg.org/spec/BPMN/2.0.2/. [4] La Rosa, M. et al., APROMORE: An advanced process model repository. Expert Systems with Applications 38(6) (2011) 7029–7040.