A model-based approach to automated testing of access control policies
A model-based approach to automated testing of access control policies
复制标题
基于模型的访问控制策略自动测试方法
DOI：
10.1145/2295136.2295173
复制
发表时间：
2012
影响因子：
7.3
通讯作者：
Y. L. Traon
中科院分区：
文献类型：
--
作者：
Dianxiang Xu;Lijo Thomas;Michael Kent;Tejeddine Mouelhi;Y. L. Traon
由于各种原因，软件系统中的访问控制策略可能无法正确实现。本文提出了一种基于模型的访问控制实现自动化测试方法。为了提供基于模型的测试过程，测试模型是通过集成相关活动的声明性访问控制规则和契约（前提条件和后设条件）来构建的。从测试模型生成访问控制测试，以执行访问控制活动的交互。测试可执行性是通过建模元素到实现构造的映射获得的。该方法已经在业界采用的测试自动化框架中实现，该框架支持以各种语言生成测试代码，例如Java、C、c++、c#和HTML/Selenium IDE。完整的基于模型的测试过程已经应用于两个用Java实现的系统。利用访问控制实现的突变分析，从访问控制故障检出率的角度评估了该方法的有效性。实验表明，基于模型的测试杀死了99.7%的突变体，剩余的突变体没有造成政策违规。
Access control policies in software systems can be implemented incorrectly for various reasons. This paper presents a model-based approach for automated testing of access control implementation. To feed the model-based testing process, test models are constructed by integrating declarative access control rules and contracts (preconditions and post-conditions) of the associated activities. The access control tests are generated from the test models to exercise the interactions of access control activities. Test executability is obtained through a mapping of the modeling elements to implementation constructs. The approach has been implemented in an industry-adopted test automation framework that supports the generation of test code in a variety of languages, such as Java, C, C++, C#, and HTML/Selenium IDE. The full model-based testing process has been applied to two systems implemented in Java. The effectiveness is evaluated in terms of access-control fault detection rate using mutation analysis of access control implementation. The experiments show that the model-based tests killed 99.7% of the mutants and the remaining mutants caused no policy violations.