Specifying security requirements and assurances of software components

In a distributed component based system, it is important to model and specify the QoS (quality of services) requirements of software components. In this paper we propose a security specification structure that can be used to model and specify required and ensured security properties of software components. The specification of security requirements can be an aid to software engineers on two main fronts: (i) to specify security requirements during the development of software components, (ii) with support for introspection, a candidate component can be queried about its required and ensured security properties by other software components or human composers in distributed environments. Our proposed specification structure is intended to capture and model pre and post execution security behaviour of software components. The paper provides a preliminary modelling of security function primitives of software components.