A formal approach to security architectures

Abstract

We define a formal language whose symbols are security goals and mechanisms. This allows us to express every security architecture as a string. Designing a security architecture becomes the task of generating a word in the language. Analysing a security architecture becomes the task of parsing a string and determining if it belongs to the language. Since not every complete security architecture achieves its goals equally efficient, we associate a complexity parameter to every goal and mechanism. This allows us to identify complexity- reducing and complexity-increasing mechanisms.