Ensuring Compliance of Architectural Design Decisions and Implementations

IT Applications have to ensure compliance the conformity to laws and regulations, which affect the architecture design and runtime of an application. In this scope, only some compliance requirements affect the functional aspects of the applications as they target for instance the supported business processes. For example, these requirements may specify an order of activities or certain time dependencies of activities following each other. A significant number of other compliance requirements affect rather the non-functional properties of the applications, such as hosting location, physical accessibility of used hardware, required logging intervals, etc. Such compliance requirements are significantly harder to ensure as they do not manifest in the applications` functions and easily observable behavior. In general, compliance requirements, therefore, lead to architectural design decisions (ADD) affecting the application design, deployment, and runtime. However, no approach exists that verifies or ensures the consistent realization of ADDs concerning compliance aspects during design time and runtime. As a means to formalize ADDs, patterns have already been used. A pattern documents proven solutions to reoccurring architectural problems in a human-readable form. The selection of a pattern to be implemented by an IT application can be seen an ADD. However, pattern formalization attempts mostly focus on structural pattern aspects and fall short in dealing with the inherent variability handled by humans during manual pattern implementation. The ADDCompliance project will investigate compliance patterns to document proven strategies in dealing with compliance requirements. In contrast to existing IT support for compliance, these compliance patterns do not consider the refinement of specific laws and regulations, but enable an application to deal with varying compliance requirements. To ensure adherence to these compliance patterns during application design and runtime, pattern documents originally followed manually by human developers will be formalized using structural and behavioral models. Using these models, the ADDCompliance project will develop method and tools to track the architectural decisions made due to compliance requirements and enforce their realization during design time and runtime of the application. These efforts will be integrated into an existing compliance enforcement and monitoring infrastructure developed as part of the DFG Co.M.B. project to significantly broaden compliance checks during business process modelling, application design and development, as well as at application runtime.

The ADDCompliance project was led by Univ.-Prof. Dr. Uwe Zdun. The goal was to study systematic ways to ensure compliance of software architectures with so-called Architecture Design Decisions (ADDs) and architecture patterns. The project was done in cooperation with the research group led by Prof. Dr. Dr. h. c. Frank Leymann (University Stuttgart). ADDCompliance was based on the observation that no formal approach existed for verifying and ensuring the compliance of ADDs. Existing models were not able to ensure that optimal ADDs are chosen for compliant system design. Thus, ADDCompliance was meant to investigate the foundations of ADDs for compliance-related architectures. In the course of the project, we performed a series of studies on systematically deriving ADDs as well as patterns and practices. These studies have led to a novel research approach in which existing best practices are first modelled in ADD models, then metrics are derived from these models. The metrics are empirically validated, and finally, refactoring actions based on these metrics are suggested. This novel approach has proven very useful in a number of further research studies, especially in our ADDCompliance follow-on project IAC2. During the project, we continuously presented our results to several industry partners. These industry partners provided us with valuable qualitative feedback from an industrial perspective regarding the feasibility of the developed methods and tools and we were able to use the feedback in our further research. Furthermore, we actively exchanged feedback with the team from University of Stuttgart. The research results were published and presented at several renowned international conferences (e.g. International Conference on Service Oriented Computing 2018 & 2020, European Conference on Software Architecture 2019, ACM/IEEE International Conference on Model Driven Engineering Languages and Systems 2018). Furthermore, the results were published as articles in prestigious scientific journals like the International Journal on Software and Systems Modeling (SoSyM) and IEEE Transactions on Software Engineering (TSE). The extensive collaboration with University of Stuttgart also led to several joint publications that were presented at conferences as well (e.g. IEEE International Conference on Services Computing 2019). A full list of publications as well as further information on the project can be found on the project website: https://addcompliance.cs.univie.ac.at/