Chong, StephenMeyden, Ron Van Der2017-11-062015Chong, Stephen, and Ron Van Der Meyden. 2015. “Using Architecture to Reason About Information Security.” ACM Transactions on Information and System Security 18 (2) (December 9): 1–30. doi:10.1145/2829949.1094-9224http://nrs.harvard.edu/urn-3:HUL.InstRepos:34330168We demonstrate, by a number of examples, that information-flow security properties can be proved from abstract architectural descriptions, that describe only the causal structure of a system and local properties of trusted components. We specify these architectural descriptions of systems by generalizing intransitive noninterference policies to admit the ability to filter information passed between communicating domains. A notion of refinement of such system architectures is developed that supports top-down development of architectural specifications and proofs by abstraction of information security properties. We also show that, in a concrete setting where the causal structure is enforced by access control, a static check of the access control setting plus local verification of the trusted components is sufficient to prove that a generalized intransitive noninterference policy is satisfied.en-USJournal Article2017-11-0610.1145/2829949