Software architecture plays a central role in developing software systems that provide basic functionality and satisfy critical properties such as reliability and security. However, little has been done to formally model software architectures and to systematically enforce required properties. We aim to propose a formal approach to designing secure software architectures. We use the Software Architecture-Model (SAM), a general software architecture-model combining Petri nets and temporal logic, as the underlying formalism. Architecture design consists of the functionality part and the security part. Guidelines are proposed to design functionality of software architectures at both element level and composition level. Software security is enforced by stepwise refinement.