  A calculus is presented for the stepwise refinement of abstract information
flow architectures. We give a mathematical model for information flow
components based on relations between input and output communication histories,
and describe system architectures using two views: the glass box view is a
network of basic components, while the black box view regards the network
itself as a component. This allows us to hierarchically compose systems. The
calculus consists of basic rules to add or remove components and channels, and
to replace components by subnetworks and vice versa. The correctness of the
rules is justified by the refinement relation on the black box view of
architectures.
