Fault-Based Testing of Combining Algorithms in XACML 3.0 Policies
Document Type
Conference Proceeding
Publication Date
2015
DOI
https://doi.org/10.18293/SEKE2015-244
Abstract
With the increasing complexity of software, new access control methods have emerged to deal with attribute-based authorization. As a standard language for attribute-based access control policies, XACML offers a number of rule and policy combining algorithms to meet different needs of policy composition. Due to their variety and complexity, however, it is not uncommon to apply combining algorithms incorrectly, which can lead to unauthorized access or denial of service. To solve this problem, this paper presents a fault-based testing approach for determining incorrect combining algorithms in XACML 3.0 policies. It exploits an efficient constraint solver to generate queries to which a given policy produces different responses than its combining algorithm-based mutants. Such queries can determine whether or not the given combining algorithm is used correctly. Our empirical studies using sizable XACML policies have demonstrated that our approach is effective.
Publication Information
Xu, Dianxiang; Sheng, Ning; and Zhang, Yunpeng. (2015). "Fault-Based Testing of Combining Algorithms in XACML 3.0 Policies". Proceedings of the International Conference on Software Engineering and Knowledge Engineering, SEKE, 433-438.