A process framework for characterising security properties of component-based software systems

We present a security characterisation process framework for software components and their compositions in order to address the issue of trust in component based software. The process is based on the idea of publishing trust related properties of software components in machine readable as well as understandable form at the component level and incorporating such properties with runtime composition of the application system. We explore the actual process involved in specifying publishable security properties of atomic components, component certification, reasoning about compositional security contracts, and characterising ultimate systems-level security properties to inspire trust in software components.