Automated test generation for access control policies

Abstract

Access control policies are increasingly written in specification languages such as XACML. To increase confidence in the correctness of specified policies, policy developers can conduct policy testing to probe the Policy Decision Point (PDP) with some typical test inputs (in the form of requests) and check test outputs (in the form of responses) against expected ones. Unfortunately, manual test generation is tedious and manually generated tests are often not sufficient to exercise various policy behaviors. In this paper we present an efficient test generation approach and its supporting tool called Targen. We further reduce the number of generated requests based on structural coverage information to facilitate manual inspection. If a rule is unreachable due to an unsatisfiable set of constraints, it is redundant. We also present an approach for redundant-rule detection based on change-impact analysis and its supporting tool call Cirg. We have evaluated Targen on policies collected from various sources, some of which are complex policies being used in real systems. Our results show that Targen can effectively generate tests to achieve high structural coverage of policies and outperforms the existing random test generation in terms of structural coverage and fault-detection capability. Cirg can identify a large number of redundant rules among rules defined in a complex, real policy.

Coverage-Based Test Cases Selection for XACML Policies

“…2) X-CREATE tool: Among the available tools for test cases generation we refer in this paper to X-CREATE 3 [15], [3], [16] showed that the fault detection effectiveness of X-CREATE test suites is similar or higher than that of comparable tools (like for instance Targen [2]). …”

“…The Targen tool [2] generates test inputs using combinatorial coverage of the truth values of independent clauses of XACML policy values. This approach has been proven to be more effective than random generation strategy in terms of structural coverage of the policy and fault detection capability [2].…”

“…The Targen tool [2] generates test inputs using combinatorial coverage of the truth values of independent clauses of XACML policy values. This approach has been proven to be more effective than random generation strategy in terms of structural coverage of the policy and fault detection capability [2]. The already mentioned X-CREATE tool [15], [3], [16] provides different strategies based on combinatorial approaches of the subject, resource, action and environment values taken from the XACML policy for deriving the access requests.…”

“…It is hence important to perform a careful testing activity both of the policy and its implementation. However, most of the test cases generation approaches available in literature for XACML policies are based on combinatorial methodologies [2], [3], thus the generated number of test cases can rapidly grow to cope with the policy complexity. Executing a huge number of test cases can drastically increase the cost of the testing phase, mainly due to the effort required to check the test results and decide whether they are correct or not.…”

A Formal Equivalence Classes Based Method for Security Policy Conformance Checking

“…The work is based on a fault model [13], a structural coverage measurement tool for defining policy coverage metrics [15] and a test generator [14], developed by two of the authors in their former work. In [16] De Angelis et al discuss access policy testing as a vital function of the trust network, in which users and service providers interact.…”