Sciweavers

ICST
2009
IEEE

Transforming and Selecting Functional Test Cases for Security Policy Testing

14 years 4 months ago
Transforming and Selecting Functional Test Cases for Security Policy Testing
In this paper, we consider typical applications in which the business logic is separated from the access control logic, implemented in an independent component, called the Policy Decision Point (PDP). The execution of functions in the business logic should thus include calls to the PDP, which grants or denies the access to the protected resources/functionalities of the system, depending on the way the PDP has been configured. The task of testing the correctness of the implementation of the security policy is tedious and costly. In this paper, we propose a new approach to reuse and automatically transform existing functional test cases for specifically testing the security mechanisms. The method includes a three-step technique based on mutation applied to security policies (RBAC, XACML, OrBAC) and AOP for transforming automatically functional test cases into security policy test cases. The method is applied to Java programs and provides tools for performing the steps from the dynamic a...
Tejeddine Mouelhi, Yves Le Traon, Benoit Baudry
Added 24 May 2010
Updated 24 May 2010
Type Conference
Year 2009
Where ICST
Authors Tejeddine Mouelhi, Yves Le Traon, Benoit Baudry
Comments (0)