A Web-Based Runtime-Reconfigurable Role Management Service

Karusseit, Martin; Margaria, Tiziana

doi:10.1109/wwv.2006.5

Cited by 9 publications

(7 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Swim lanes declaratively express the alternative behaviors the system offers in each state and • control-flow graphs realizing system functionality like the deadline expiration of phases. The OCS is a role-based system [11], meaning that in a given state different roles may have distinct action potentials. Therefore roles need to be kept distinct in our models.…”

Section: The Ocsmentioning

confidence: 99%

Automated continuous quality assurance

Neubauer¹,

Steffen²,

Bauer³

et al. 2012

2012 First International Workshop on Formal Methods in Software Engineering: Rigorous and Agile Approaches (FormSERA)

Self Cite

View full text Add to dashboard Cite

We present a case study that illustrates the power of active learning for enabling the automated quality assurance of complex and distributed evolving systems. We illustrate how the development of the OCS, Springer Verlag's Online Conference System, is supported by continuous learning-based testing, that by its nature maintains the synchrony of the running application and the learned (test) model. The evolution of the test model clearly indicates which portions of the system remain stable and which are altered. Thus our approach includes classical regression testing and feature interaction detection. We show concretely how model checking, automata learning, and quantitative analysis concur with the holistic quality assurance of this product.Keywords-active learning, quality assurance, model-based testing. I. MOTIVATIONIn a systems lifecycle, the effort spent for quality assurance and in particular testing often exceeds the development time. Already the combined testing effort prior to the first customer installation lies typically well above 20-30% of the overall costs, and this percentage gets higher with each new patch or upgrade. Still, far too many functional bugs escape the testing phases, and things get worse if one also considers non-functional properties like performance, which require specific (stress) test, or even user acceptance (of certain features), which can only be revealed via monitoring of the real user behavior. The speedup in releases and deployment advocated by many in industry [5] in the context of business critical applications will be realizable only, if adequate quality assurance mechanisms provide a variety of immediate and diagnosis-friendly feedback at the different stages of the lifecycle.The case study presented in this paper summarizes the experience we gained during the development, validation, actual operation, and use of the Online Conference Service (OCS), Springer Verlag's online manuscript submission and review system. Flexibility to add and adapt features is a must for the OCS, as it serves quite different scientific disciplines (besides Computer Science and Mathematics also various engineering disciplines etc.) all of them with their special requirements. Thus guaranteeing stability, security, and adequate performance is a challenging task which we address by a novel continuous quality assurance approach, which is in particular sensitive to the actual run-time behavior on its enterprise platform operated and maintained by Springer in the Netherlands.Backbone of this continuous quality assurance in the OCS life-cycle is (active) automata learning [1], here applied as a technology to infer behavioral models of the fully deployed enterprise-level system via systematic testing. We will discuss how this approach helps to identify and to resolve unwanted feature interactions [6], to reveal quantitative aspect that indicate performance problems, and to aggregate monitored user behavior along the perviously learned behavioral models. Besides applying advanced automata learning techn...

show abstract

Section: The Ocsmentioning

confidence: 99%

Automated continuous quality assurance

Neubauer¹,

Steffen²,

Bauer³

et al. 2012

2012 First International Workshop on Formal Methods in Software Engineering: Rigorous and Agile Approaches (FormSERA)

Self Cite

View full text Add to dashboard Cite

show abstract

“…It is now hosted by Springer Verlag on their premises in Dordrecht (NL) to support events with LNCS proceedings and it is currently being tightly integrated with Springer's volume production process. A description of the service and of its method of development is available in [6,7].…”

Section: Policies and Access Control Needs In Ocsmentioning

confidence: 99%

“…In the OCS we use an own concept of role-based management of user rights, as described in [6]. A role is a collection of rights, which gives users the permission to access an object, feature, or service.…”

Section: Basic Access Control In the Ocsmentioning

confidence: 99%

“…This computation is done by our access control engine [6] during runtime. The engine takes into account all specific permissions and restrictions, and is responsible for active control of varying user's rights.…”

Section: Basic Access Control In the Ocsmentioning

confidence: 99%

“…We illustrate jABC's facilities for policy expression and checking (Sect. 3.1) on the example of the Online Conference Service (OCS) [6,7]. In particular we investigate how to specify, apply, and verify policies in a dynamic and process-oriented way and compare them with the previous two (Sect.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Policy expression and checking in XACML, WS-Policies, and the jABC

Karusseit

Margaria

Willebrandt

2008

Proceedings of the 2008 Workshop on Testing, Analysis, and Verification of Web Services and Applications

Self Cite

View full text Add to dashboard Cite

Web-based access to sensitive and confidential data is realized today via different approaches, using a variety of methods to specify and combine access control policies. In an optic of change management and evolution, a structured and flexible model is needed to handle dynamicity, particularly when handling rights in systems with many users which hold different roles. Furthermore the validation of security constraints is an important key to warrant the reliability of control mechanisms.This paper compares the temporal logic-based approach for modeling access control used by the jABC framework with two popular XML-based description languages (XACML and WS-Policy), which are quasi-standards for policy expression in Web applications. Its usage is illustrated here on the example of the web-based Online Conference Service (OCS). The respective functionalities are described and examined in consideration of their ability to validate and enforce the needed policies.

show abstract

Making Sense of Complex Applications: Constructive Design, Features, and Questions

Margaria

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

A Web-Based Runtime-Reconfigurable Role Management Service

Cited by 9 publications

References 7 publications

Automated continuous quality assurance

Automated continuous quality assurance

Policy expression and checking in XACML, WS-Policies, and the jABC

Making Sense of Complex Applications: Constructive Design, Features, and Questions

Contact Info

Product

Resources

About