Automatic XACML requests generation for policy testing

Proceedings - IEEE 5th International Conference on Software Testing, Verification and Validation, ICST 2012

Volumn , Issue , 2012, Pages 842-849

  Bertolino, Antonia ^a   Daoudagh, Said ^a   Lonetti, Francesca ^a   Marchetti, Eda ^a  

^a ISTI CNR   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS CONTROL POLICIES; ACCURATE TESTING; ERROR-PRONE PROCESS; FAULT DETECTION EFFECTIVENESS; FUNDAMENTAL PROPERTIES; MUTATION TESTING; TEST CASE; TEST STRATEGIES; XACML POLICIES;

ACCESS CONTROL;

SOFTWARE TESTING;

EID: 84862306023     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICST.2012.185     Document Type: Conference Paper

References (16)

1. OASIS, "eXtensible Access Control Markup Language (XACML) Version 2.0," http://docs.oasis-open.org/xacml/2.0/access control-xacml-2.0-core- spec-os.pdf, February 1 Feb 2005.
2. A. Bertolino, F. Lonetti, and E. Marchetti, "Systematic XACML Request Generation for Testing Purposes," in Proc. of 36th EUROMICRO Conference on Software Engineering and Advanced Applications (SEAA), 2010, pp. 3-11.
3. E. Martin and T. Xie, "Automated test generation for access control policies," in Supplemental Proc. of ISSRE, November 2006.
4. N. Zhang, M. Ryan, and D. Guelev, "Evaluating access control policies through model checking," in Information Security, ser. Lecture Notes in Computer Science, J. Zhou, J. Lopez, R. Deng, and F. Bao, Eds. Springer Berlin / Heidelberg, 2005, vol. 3650, pp. 446-460.
5. G. Hughes and T. Bultan, "Automated verification of access control policies," Technical Report 2004-22. Comp. Science Dep., Univ. of California, Santa Barbara, CA, 2004.
6. K. Fisler, S. Krishnamurthi, L. Meyerovich, and M. Tschantz, "Verification and change-impact analysis of access-control policies," in Proc. of ICSE, 2005, pp. 196-205.
7. E. Martin and T. Xie, "Automated test generation for access control policies via change-impact analysis," in Proc. of Third International Workshop on Software Engineering for Secure Systems (SESS), 2007, pp. 5-12.
8. Y. Traon, T. Mouelhi, and B. Baudry, "Testing security policies: going beyond functional testing," in Proc. of ISSRE, 2007, pp. 93-102.
9. A. Pretschner, T. Mouelhi, and Y. Le Traon, "Model-based tests for access control policies," in Proc. of ICST, 2008, pp. 338-347.
10. T. J. Ostrand and M. J. Balcer, "The category-partition method for specifying and generating functional tests," Commun. ACM, vol. 31, no. 6, pp. 676-686, 1988.
11. D. M. Cohen, S. R. Dalal, M. L. Fredman, and G. C. Patton, "The AETG system: An approach to testing based on combinatiorial design," IEEE Trans. on Soft. Eng., vol. 23, no. 7, pp. 437-444, Jul. 1997.
12. X-CREATE, http://labsewiki.isti.cnr.it/labse/tools/xcreate/public/main.
13. TAS3 Project, "Trusted Architecture for Securely Shared Services,"http://www.tas3.eu/.
14. R. DeMillo, R. Lipton, and F. Sayward, "Hints on test data selection: Help for the practicing programmer," Computer, vol. 11, no. 4, pp. 34-41, 1978. (Pubitemid 8631038)
15. E. Martin and T. Xie, "A fault model and mutation testing of access control policies," in Proc. of WWW, May 2007, pp. 667-676.
16. Sun Microsystems, "Sun's XACML Implementation,"http://sunxacml. sourceforge.net/, 2006.