Automated test generation for access control policies via change-impact analysis

Proceedings - ICSE 2007 Workshops: Third International Workshop on Software Engineering for Secure Systems, SESS'07

Volumn , Issue , 2007, Pages

  Martin, Evan ^a   Tao, Xie ^a  

^a NORTH CAROLINA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER PROGRAMMING LANGUAGES; FAULT DETECTION; RANDOM PROCESSES;

AUTOMATED TEST GENERATION; CHANGE-IMPACT ANALYSIS; RANDOM TEST GENERATION;

ACCESS CONTROL;

EID: 38549181721     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SESS.2007.5     Document Type: Conference Paper

References (20)

1. OASIS extensible Access Control Markup Language (XACML). http: //www.:oasis-open.org/comlllees/xacml/,2005.
2. Sun's XACML implementation. http://sunxacml.sourceforge. net/,2005.
3. P. E. Arnmann, P. E. Black, and W. Majurski. Using model checking to generate tests from specifications. In Proc. 2rd IEEE International Conference on Formal Engineering Methods, pages 46 54, 1998.
4. D. Beyer. A. J. Chlipala. and R. Majumdar. Generating tests from counterexamples. In Proc. 26th International Conference on Software Engineering, pages 326-335, 2004.
5. E. Clarke, M. Fujita, P. McGeer, J. Yang, and X. Zhao. Multi-terminal binary decision diagrams: An efficient data structure for matrix representation. In Proc. International Workshop on Logic Synthesis, pages 149-169. 1993.
6. C. Csallner and Y. Smaragdakis. Check V Crash: Combining static checking and testing. In Proc. 27th International Conference on Software Engineering, pages 422 431, 2005.
7. N. Damianou, N. Dulay, E. Lupu, and M. Sloman, The Ponder policy specification language. In Proc. International Workshop on Policies for Distributed Systems and Networks, pages 18-38, 2001.
8. K. Fisler, S. Krishnamurthi, L. A. Meyerovich. and M. C. Tschantz, Verification and change-impact analysis of access-control policies. In Proc. 27th International Conference on Software Engineering, pages 196-205, 2005.
9. A. Gargantini and C. Heitmeyer, Using model checking to generate tests from requirements specifications. "in Proc. 7th ESEC/FSE, pages 146 162, 1999.
10. M. J. Harrold, R. Gupta, and M. L. Soffa. A methodology for controlling the size of a test suite. ACM Trans. Softw. Eng. Methodol., 2(3):270-285, 1993.
11. T. A. Henzinger. R. Jhala, R. Majumdar, and G. Sutre, Lazy abstraction. In Proc. 29th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 58-70, 2002.
12. G. Hughes and T. Bultan, Automated verification of access control policies, Technical Report 2004-22, Department of Computer Science, University of California, Santa Barbara, 2004.
13. D. Jackson, I. Shlyakhter, and M. Sridharan, A micromodularity mechanism, In Proc. 8th ESEC/FSE, pages 62-73, 2001.
14. B. Korel and A. M. Al-Yami, Automated regression test generation. In Proc. 1998 ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 143-152, 1998.
15. K. R. M. Leino, G. Nelson, and J. B. Saxe. ESC/Java user's manual. Technical Report 2000-002, Compaq Systems Research Center, Palo Alio, CA. October 2000.
16. E. Martin and T. Xie. A fault model and mutation testing of access control policies. In Proc. 11th International Conference on World Wide Web. 2007.
17. E. Martin, T. Xie, and T. Yu, Defining and measuring policy coverage in testing access control policies. In Proc. 8th International Conference on Information and Communications Security, pages 139-158, 2006.
18. L. Xu, M. S. Dias, and D. J. Richardson. Generating regression tests via model checking. In Proc. 28th International Computer Software and Applications Conference, pages 336-341, 2004.
19. N. Zhang, M. Ryan, and D. P. Guelev, Synthesising verified access control systems in XACML. In Proc. ACM Workshop on Formal Methods in Security Engineering, pages 56-65, 2004.
20. N. Zhang, M. Ryan, and D. P. Guelev, Evaluating access control policies through model checking. In Proc. 8th International Conference on Information Security, pages 446-460, 2005.