An automated model-based test oracle for access control systems

Bertolino, Antonia; Daoudagh, Said; Lonetti, Francesca; Marchetti, Eda

doi:10.1145/3194733.3194743

Cited by 8 publications

(4 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several approaches [54,55,2,3,4,56,5,57,58,59,60,61] generate access control test cases from AC policy specifications to detect AC defects in the implementations; policy specifications are defined using XACML [54,2,3,59] or declarative access control rules [4,57]. In general, these approaches are model-based and generate test models or abstract test cases that cover various (combinations of) AC rules embedded in policy specifications.…”

Section: Detection Of Ac Defects and Vulnerabilitiesmentioning

confidence: 99%

“…In general, these approaches are model-based and generate test models or abstract test cases that cover various (combinations of) AC rules embedded in policy specifications. The scope of these approaches also vary: generating executable test cases (e.g., [57], prioritizing test case execution based on a given test budget constraints (e.g., [54]), localizing faults (e.g., [58]), generating test oracles (e.g., [60,61]); other approaches [62,59] focus on proposing coverage criteria, such as AC rule coverage, rule pair coverage, and modified condition/decision coverage, to measure and ensure the quality of (AC) test suites. Daoudagh et al [6] conducted a systematic literature review on 20 studies that focus on testing of the usage and access control systems inside DevOps processes.…”

Section: Detection Of Ac Defects and Vulnerabilitiesmentioning

confidence: 99%

See 1 more Smart Citation

Automated reverse engineering of role-based access control policies of web applications

Shar

Bianculli

et al. 2022

Journal of Systems and Software

View full text Add to dashboard Cite

Access control (AC) is an important security mechanism used in software systems to restrict access to sensitive resources. Therefore, it is essential to validate the correctness of AC implementations with respect to policy specifications or intended access rights. However, in practice, AC policy specifications are often missing or poorly documented; in some cases, AC policies are hard-coded in business logic implementations. This leads to difficulties in validating the correctness of policy implementations and detecting AC defects.In this paper, we present a semi-automated framework for reverse-engineering of AC policies from Web applications. Our goal is to learn and recover role-based access control (RBAC) policies from implementations, which are then used to validate implemented policies and detect AC issues. Our framework, built on top of a suite of security tools, automatically explores a given Web application, mines domain input specifications from access logs, and systematically generates and executes more access requests using combinatorial test generation. To learn policies, we apply machine learning on the obtained data to characterize relevant attributes that influence AC. Finally, the inferred policies are presented to the security engineer, for validation with respect to intended access rights and for detecting AC issues. Inconsistent and insufficient policies are highlighted as potential AC issues, being either vulnerabilities or implementation errors.We evaluated our approach on four Web applications (three open-source and a proprietary one built by our industry partner) in terms of the correctness of inferred policies. We also evaluated the usefulness of our approach by investigating whether it facilitates the detection of AC issues. The results show that 97.8% of the inferred policies are correct with respect to the actual AC implementation; the analysis of these policies led to the discovery of 64 AC issues that were reported to the developers.

show abstract

Section: Detection Of Ac Defects and Vulnerabilitiesmentioning

confidence: 99%

Section: Detection Of Ac Defects and Vulnerabilitiesmentioning

confidence: 99%

Automated reverse engineering of role-based access control policies of web applications

Shar

Bianculli

et al. 2022

Journal of Systems and Software

View full text Add to dashboard Cite

show abstract

“…Wang et al [10] realized data storage and sharing without the participation of providers, using Ethereum and an attributebased access control method. Furthermore, many other researchers have studied the access control strategy described by XACML about Policies formalization [11], Automatic Testing [12], Model testing [13], policy tracing [14], automated fault localization [15].…”

Section: Literature Reviewmentioning

confidence: 99%

Detection of Conflicts Between Resource Authorization Rules in Extensible Access Control Markup Language Based on Dynamic Description Logic

Yang¹,

Tan²

2020

ISI

View full text Add to dashboard Cite

For resources in an open environment, the access control rules (ACRs), which are described by extensible access control markup language (XACML), might have conflicts between each other. To improve the rule management, the root causes of rule conflicts must be identified. This paper firstly formally models the resource attributes by dynamic description logic (DDL), and then investigates inference problems like attribute consistency and rule satisfiability by setting up concept, instance and action knowledge bases. Next, DDL-based rule conflict detection algorithms were designed to identify possible rule conflicts. Finally, the feasibility and decidability of the proposed algorithms were verified through experiments on expanded Continue dataset. The research results provide new insights to the detection of conflicts between resource authorization rules (RARs).

show abstract

“…According to the results collected in Daoudagh et al, 12 there are not specific research methods or techniques applicable during the development of access control systems. Usually, the available proposals include either methodologies for requirement specification and collection in order to improve policies specification (such as previous studies [13][14][15][16] ) or techniques for improving the policies enforcement (such as previous studies [17][18][19][20] ), but they do not provide specific approaches.…”

Section: Access Control Mechanisms and Policiesmentioning

confidence: 99%

An automated framework for continuous development and testing of access control systems

Daoudagh

Lonetti

Marchetti

2020

J Software Evolu Process

Self Cite

View full text Add to dashboard Cite

Automated testing in DevOps represents a key factor for providing fast release of new software features assuring quality delivery. In this paper, we introduce DOXAT, an automated framework for continuous development and testing of access control mechanisms based on the XACML standard. It leverages mutation analysis for the selection and assessment of the test strategies and provides automated facilities for test oracle definition, test execution, and results analysis, in order to speedup and automate the Plan, Code, Build, and Test phases of DevOps process. We show the usage of the framework during the planning and testing phases of the software development cycle of a PDP example.

show abstract

An automated model-based test oracle for access control systems

Cited by 8 publications

References 18 publications

Automated reverse engineering of role-based access control policies of web applications

Automated reverse engineering of role-based access control policies of web applications

Detection of Conflicts Between Resource Authorization Rules in Extensible Access Control Markup Language Based on Dynamic Description Logic

An automated framework for continuous development and testing of access control systems

Contact Info

Product

Resources

About