A formal approach for testing security rules

Abstract

Nowadays, security policies are the key point of every modern infrastructure. The specification and the testing of such policies are the fundamental steps in the development of a secure system since any error in a set of rules is likely to harm the global security. To address both challenges, we propose a framework to specify security policies and test their implementation on a system. Our framework makes it possible to generate in an automatic manner, test sequences, in order to validate the conformance of a security policy. system behavior is specified using a formal description technique based on extended finite state machine (EFSM) [12]. The integration of security rules within the system specification is performed by specific algorithms. Then, the automatic tests generation is performed using a dedicated tool, called SIRIUS, developed in our laboratory. Finally, we briefly present a weblog system as a case study to demonstrate the reliability of our framework.

Testing Security Rules with Decomposable Activities

“…It generalizes our previous work that covers testing rules with atomic activities [16] by considering decomposed ones through the conception of new integration algorithms.…”

Testing Obligation Policy Enforcement Using Mutation Analysis

“…In [11], Xie et al proposed a new tool Cirg that automatically generates test for XACML policies using Change-Impact Analysis. Several researchers generate tests from access control policies using various forms of state machines [12], [23]. In addition, Several studies propose the use of fault-injection or mutation targeting different aspects of security testing.…”

Supporting Customized Views for Enforcing Access Control Constraints in Real-Time Collaborative Web Applications

“…The next step is to apply this configuration to our ViewModel. To this end, the JSON-encoded result of the View Service is parsed, and each entry in the result is applied to the local viewModel variable (lines [12][13][14][15].…”

“…In [1], Belchior and colleagues model RBAC policies using RDF triples and N3Logic rules. Mallouli et al [13] use extended finite state machines (EFSM) to model systems with OrBAC [11] (Organization Based Access Control) security policies. However, none of these approaches addresses the enforcement of access control policies and entailment constraints in dynamic real-time Web applications.…”