Similarity testing for access control

Abstract

a b s t r a c tContext: Access control is among the most important security mechanisms, and XACML is the de facto standard for specifying, storing and deploying access control policies. Since it is critical that enforced policies are correct, policy testing must be performed in an effective way to identify potential security flaws and bugs. In practice, exhaustive testing is impossible due to budget constraints. Therefore the tests need to be prioritized so that resources are focused on their most relevant subset. Objective: This paper tackles the issue of access control test prioritization. It proposes a new approach for access control test prioritization that relies on similarity. Method: The approach has been applied to several policies and the results have been compared to random prioritization (as a baseline). To assess the different prioritization criteria, we use mutation analysis and compute the mutation scores reached by each criterion. This helps assessing the rate of fault detection. Results: The empirical results indicate that our proposed approach is effective and its rate of fault detection is higher than that of random prioritization. Conclusion: We conclude that prioritization of access control test cases can be usefully based on similarity criteria.

Similarity testing for role-based access control systems

“…Similarity testing is a promising test case prioritization approach that uses similarity functions to calculate the degree of similarity between pairs of tests and define test ordering (Cartaxo et al 2011;Bertolino et al 2015;Coutinho et al 2014). It is an all-toall comparison problem (Zhang et al 2017) and, as most test prioritization algorithms (Elbaum et al 2002), it has complexity O(n 2 ).…”

“…It is an all-toall comparison problem (Zhang et al 2017) and, as most test prioritization algorithms (Elbaum et al 2002), it has complexity O(n 2 ). It assumes that resembling test cases are redundant in a sense they cover the same features of an SUT and tend to have equivalent fault detection capabilities (Bertolino et al 2015).…”

“…After calculating the similarity matrix, test ordering is defined based on similarity degrees (Cartaxo et al 2011;Bertolino et al 2015;Henard et al 2014;Coutinho et al 2014). According to Elbaum et al (2002), the ordering process can use total or additional information.…”

“…A test prioritization criterion that has recently shown very promising results is similarity testing (Cartaxo et al 2011;Bertolino et al 2015). In similarity testing, we assume that resembling test cases tend to cover identical parts of an SUT, have equivalent fault detection capabilities, and no additional gain can be expected if executed simultaneously.…”

“…In similarity testing, we assume that resembling test cases tend to cover identical parts of an SUT, have equivalent fault detection capabilities, and no additional gain can be expected if executed simultaneously. This concept has been investigated under MBT (Cartaxo et al 2011), access control testing (Bertolino et al 2015) and software product line (SPL) testing (Henard et al 2014) domains, but it has never been applied to RBAC. Moreover, since the fault detection effectiveness of test criteria are strongly related to its ability to represent faults of specific domains (Felderer et al 2015), similarity testing may not be necessarily effective on RBAC domain.…”