Using change patterns to incorporate evolving trust relationships into a software architecture

When designing a secure software architecture, the architect must take possible evolution of the system and its environment into account. Inevitably, during the lifetime of the application, changes will occur that reduce the security of the system. It is crucial that these changes are anticipated, and that they can be accomodated with minimal impact on the architecture. This report introduces the concept of `change patterns', providing guidance to the architect to achieve this goal. A change pattern guides the architect in designing an architecture that is resistant against certain foreseen evolutions of the requirements and assumptions. It explicitly records the change of requirements or assumptions it supports. After the architect has selected appropriate change patterns, applying a pattern consists of two steps. First, the architecture needs to be prepared up-front for the evolution (even though it has not yet occurred), based on a likelihood and importance analysis of the evolution. Second, once the evolution occurs, the architect is triggered to perform the necessary steps to update the application such that it conforms to the new situation. These two steps are reflected in the solutions that belong to the change pattern: architectural patterns for the up-front preparation, and change guidance for performing the actual update of the application. This report contains a description of a change pattern, an outline of a process to use change patterns, and a catalogue of eight change patterns for evolving trust relationships, and an illustration of their use.nrpages: 54status: publishe