TTP: Small: Automated Conformance Testing of Access Control and Obligation Policies

TTP：小：访问控制和义务策略的自动一致性测试

• 批准号: 1359590
• 负责人: Dianxiang Xu
• 金额: $ 49.98万
• 依托单位: Boise State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-01 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1359590&HistoricalAwards=false
• 关键词: TTP; Small; Automated; Conformance; Testing

Attributed-based obligatory access control is a new access control paradigm for achieving fine-grained authorization and assured system accountability. However, access control and obligation policies can be implemented incorrectly for various reasons, such as programming errors and misunderstanding about the policies. It is important to reveal discrepancy between the policy specification and the actual system implementation. The objective of this ?Transition To Practice? project is to develop an open source tool for model-based testing of attribute-based access control and obligation policies. It can build test models by integrating attribute-based access control and obligation rules with functional test models, generate test cases from the test models to meet given coverage criteria, and transform model-level test cases into executable code in a target language and test execution environment. The test code can then be executed with the system under test to exercise the access control and obligation policies. The tool is applicable to a great variety of systems due to the support for various programming languages and test execution environments. It is independent of how access control and obligation policies are implemented in the system under test. The broader impacts of this project include deployment of the tool to various academic and industry projects and involvement of students, particularly undergraduate students, in cutting-edge research.

基于属性的强制性访问控制是一种新的访问控制模式，可以实现细粒度的授权和有保证的系统责任。然而，访问控制和义务策略可能由于各种原因而不正确地实现，例如编程错误和对策略的误解。重要的是要揭示政策规范和实际系统实现之间的差异。目的是什么？过渡到实践？项目的目的是开发一个开放源码工具，用于对基于属性的访问控制和义务政策进行基于模型的测试。它可以通过将基于属性的访问控制和义务规则与功能测试模型相结合来构建测试模型，从测试模型生成满足给定覆盖标准的测试用例，并将模型级测试用例转换为目标语言和测试执行环境中的可执行代码。然后，测试代码可以与被测系统一起执行，以执行访问控制和义务策略。该工具适用于各种各样的系统，由于支持各种编程语言和测试执行环境。它独立于在被测系统中如何实现访问控制和义务策略。该项目的更广泛影响包括将该工具部署到各种学术和行业项目，以及学生，特别是本科生参与尖端研究。