A Semantic Paradigm for Component-Based Specification Integrating a Notion of Security Risk

Abstract

Abstract. We propose a semantic paradigm for component-based specification supporting the documentation of security risk behaviour. By security risk, we mean behaviour that constitutes a risk with regard to ICT security aspects, such as confidentiality, integrity and availability. The purpose of this work is to investigate the nature of security risk in the setting of component-based system development. A better understanding of security risk at the level of components facilitates the prediction of risks related to introducing a new component into a system. The semantic paradigm provides a first step towards integrating security risk analysis into the system development process.

Using model-based security analysis in component-oriented system development

“…We build composites using the basic composition operators of STAIRS. For the full details of the semantics of composite component specifications, see [1].…”

“…We refer to [1] for the full details of composite security risk specifications. If the identified risks are found to violate the risk acceptance criteria, we need to identify protection mechanisms to ensure that the requirements to protection are met.…”

“…A provided interface represent the view of the user, who does not need to know how an operation is implemented. Formally we obtain the provided interface of a basic component by filtering away the interactions on the required interface[1].…”