Istituto di Scienza e Tecnologie dell'Informazione     
Bertolino A., Daoudagh S., Lonetti F., Marchetti E. Automatic XACML requests generation for policy testing. In: SecTest 2012/ICST 2012 - IEEE Fifth International Conference on Software Testing, Verification and Validation. The Third International Workshop on Security Testing (Montreal, QC, Canada, 17-21 April 2012). Proceedings, pp. 842 - 849. IEEE, 2012.
Access control policies are usually specified by the XACML language. However, policy definition could be an error prone process, because of the many constraints and rules that have to be specified. In order to increase the confidence on defined XACML policies, an accurate testing activity could be a valid solution. The typical policy testing is performed by deriving specific test cases, i.e. XACML requests, that are executed by means of a PDP implementation, so to evidence possible security lacks or problems. Thus the fault detection effectiveness of derived test suite is a fundamental property. To evaluate the performance of the applied test strategy and consequently of the test suite, a commonly adopted methodology is using mutation testing. In this paper, we propose two different methodologies for deriving XACML requests, that are defined independently from the policy under test. The proposals exploit the values of the XACML policy for better customizing the generated requests and providing a more effective test suite. The proposed methodologies have been compared in terms of their fault detection effectiveness by the application of mutation testing on a set of real policies.
URL: http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=6200197&contentType=Conference+Publications&sortType%3Dasc_p_Sequence%26filter%3DAND%28p_IS_Number%3A6200080%29%26pageNumber%3D6
DOI: 10.1109/ICST.2012.185
Subject Access control policy
D.2.5 Testing and Debugging
D.4.6 Security and Protection. Access controls

Icona documento 1) Download Document PDF

Icona documento Open access Icona documento Restricted Icona documento Private


Per ulteriori informazioni, contattare: Librarian http://puma.isti.cnr.it

Valid HTML 4.0 Transitional