Test generation and execution for security rules in temporal logic

Darmaillacq, V.; Richier, Jean-Luc; Groz, Roland

doi:10.1109/icstw.2008.41

Cited by 6 publications

(1 citation statement)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Darmaillacq and al. proposed in [3] a semi automatic method in order to generate tests for the conformance of a system to a SP which can be directly executed on the system. They specified the system, the rules and test patterns manually and used a dedicated tool in order to drive tests.…”

Section: A Related Workmentioning

confidence: 99%

Towards a test cases generation method for Security Policies

Abbassi¹,

Fatmi²

2009

2009 International Conference on Telecommunications

View full text Add to dashboard Cite

Security Policy specification and testing constitute two fundamental challenges in the development of secure communication systems since they can ensure that a security policy is correctly enforced. Model checking techniques can be used to do such task. Given a system modeling and a test criterion, the model checker can generate a counterexample from which test cases can be deduced. To address the previous challenges, we propose in this paper, a framework to specify a security policy and to test its implementation. This framework is characterized as follows: (1) the security policy enforcement is specified through a new modeling language, SPromela, (2) the test criteria are expressed by the use of a temporal logic LTL and (3) the test cases are generated by a classical model checking technique.

show abstract

Section: A Related Workmentioning

confidence: 99%

Towards a test cases generation method for Security Policies

Abbassi¹,

Fatmi²

2009

2009 International Conference on Telecommunications

View full text Add to dashboard Cite

show abstract

Model-based security testing: a taxonomy and systematic classification

Felderer

Zech

Breu

et al. 2015

Softw. Test. Verif. Reliab.

View full text Add to dashboard Cite

Model-based security testing relies on models to test whether a software system meets its security requirements. It is an active research field of high relevance for industrial applications, with many approaches and notable results published in recent years. This article provides a taxonomy for model-based security testing approaches. It comprises filter criteria (i.e. model of system security, security model of the environment and explicit test selection criteria) as well as evidence criteria (i.e. maturity of evaluated system, evidence measures and evidence level). The taxonomy is based on a comprehensive analysis of existing classification schemes for model-based testing and security testing. To demonstrate its adequacy, 119 publications on model-based security testing are systematically extracted from the five most relevant digital libraries by three researchers and classified according to the defined filter and evidence criteria. On the basis of the classified publications, the article provides an overview of the state of the art in model-based security testing and discusses promising research directions with regard to security properties, coverage criteria and the feasibility and return on investment of model-based security testing. 120 M. FELDERER ET AL. 9126 [4] defining security as a functional quality characteristic. However, it seems desirable that security testing directly targets the previous security properties, as opposed to taking the detour of functional tests of security mechanisms. This view is supported by the ISO/IEC 25010 [2] standard that revises ISO/IEC 9126 and introduces security as a new quality characteristic that is not included in the characteristic functionality any more.Because the former kind of (non-functional) security properties describes all executions of a system, this kind of security testing is intrinsically hard. Because testing cannot show the absence of faults, an immediately useful perspective directly considers the violation of these properties. This has resulted in the development of specific testing techniques such as penetration testing that simulates attacks to exploit vulnerabilities. Penetration tests are difficult to craft because tests often do not directly cause observable security exploits, and because the testers must think like an attacker [5], which requires specific expertise. During penetration testing, testers build a mental model of security properties, security mechanisms and possible attacks against the system and its environment. It seems intuitive that security testing can benefit from specifying these security test models in an explicit and processable way. Security test models provide guidance for the systematic and effective specification and documentation of security test objectives and security test cases, as well as for their automated generation and evaluation.The variant of testing that relies on explicit models that encode information on the system under test and/or its environment is called model-based testing (MBT) [6,7]. Especially in ...

show abstract

More testable properties

Falcone

Fernandez

Jéron

et al. 2011

Int J Softw Tools Technol Transfer

View full text Add to dashboard Cite

Abstract. In this paper, we explore the set of testable properties within the Safety-Progress classification where testability means to establish by testing that a relation, between the tested system and the property under scrutiny, holds. We characterize testable properties wrt. several relations of interest. For each relation, we give a sufficient condition for a property to be testable. Then, we study and delineate, for each Safety-Progress class, the subset of testable properties and their corresponding test oracle producing verdicts for the possible test executions. Finally, we address automatic test generation for the proposed framework.

show abstract

Test generation and execution for security rules in temporal logic

Cited by 6 publications

References 10 publications

Towards a test cases generation method for Security Policies

Towards a test cases generation method for Security Policies

Model-based security testing: a taxonomy and systematic classification

More testable properties

Contact Info

Product

Resources

About