Automated Test Generation for Access Control Policies via Change-Impact Analysis

Abstract

Access control policies are increasingly written in specification languages such as XACML. To increase confidence in the correctness of specified policies, policy developers can conduct policy testing with some typical test inputs (in the form of requests) and check test outputs (in the form of responses) against expected ones. Unfortunately, manual test generation is tedious and manually generated tests are often not sufficient to exercise various policy behaviors. In this paper we present a novel framework and its supporting tool called Cirg that generates tests based on changeimpact analysis. Our experimental results show that Cirg can effectively generate tests to achieve high structural coverage of policies and outperforms random test generation in terms of structural coverage and fault-detection capability.

Coverage-Based Test Cases Selection for XACML Policies

“…In addition, other approaches (like for instance [24], [27], [28]), which are more generic than ours could be also taken into consideration and compared to our proposed approach.…”

“…The policy target (lines [5][6][7][8][9][10][11][12] says that this policy applies to any subject, any action, any environment and the "books" resource. This policy has a first rule (ruleA) (lines 13-34) with a target (lines [14][15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33] specifying that this rule applies only to the access requests of a "read" action of "books", and "documents" resources with any environment. The effect of the second rule (ruleB) (lines 35-50) is Permit when the subject is "Julius", the action is "write", the resource and environment are any resource and any environment respectively.…”

“…Such approaches automatically derive abstract test cases that have to be then refined into concrete XACML requests for being executed on a PDP. A different approach is provided by Cirg [24] that is able to exploit change-impact analysis for test cases generation starting from policy specification.…”

A threat model‐based approach to security testing

“…The algorithm then analyzes the nodes in the set of test sequences until every node that matches CurrentNode in every sequence is replaced with a leaf node by using the following replacement method. (1) If CurrentNode is in a test sequence that has children with an AND relationship, replace CurrentNode with these children in that sequence in the left-to-right order in which they appear in the tree (lines [12][13][14][15][16][17][18][19][20][21][22]. (2) If CurrentNode is in a test sequence that has children with an OR relationship, we create the same number of sequences as children of the CurrentNode and replace CurrentNode in each of these sequences with one of the children of the OR relationship.…”

“…To date, researchers have developed various security testing techniques. These include techniques that generate test cases or identify vulnerabilities focusing on specific attacks, such as SQL injection or cross-site scripting (XSS) [4][5][6][7]; generate test cases using model-based approaches, such as threat modeling or use case modeling [8][9][10][11][12]; and generate test cases from control policy specifications [13,14] (Section 2 provides details).…”