This paper presents a framework for constructing compositional security contracts (CsC) based on the security property exposed by the atomic component. The framework uses intelface structure of components in order to determine the CsC of software components. An active inteface provides the component a basis for reasoning and assessing a component's suitability to meet certain security requirements of a particular application. Based on the security i n f o m i o n available from the component inte face, an active intelface can reason whether the candidate component meets the security requirements for an envisaged systemwide application. Any security mismatches or discrepancies between components can be identified by the participating components before an actual composition takes place. Exposing the security properties of software components can be the basis for a trust relationship among components, and the exposed security could affect the underlying security of the enclosing system.
The security property descriptions of the components based on the security assessment standards of information technology were proposed by Khan et al. REF .
A framework for an active interface to characterise compositional security contracts of software components
Proceedings 2001 Australian Software Engineering Conference
Proceedings 2001 Australian Software Engineering Conference
Computer Science