Constructing secure distributed systems using components

Current hookup theories may impose overstrong security requirements on component systems. To overcome this problem, connectivities of the components may have to be considered in order to appropriately handle their composition. Such a consideration is used here to describe composable security properties. Security requirements are enforced only on some input and output entities of each component with regard to its connectivity, and communication constraints on its others so as to ensure that their entire system can satisfy its security requirement. This enables the system and its components to possess different security properties, i.e., the security property of the system can be logically stronger than security properties of its components.<
>