TTP: Small: Automated Conformance Testing of Access Control and Obligation Policies

TTP：小：访问控制和义务策略的自动一致性测试

• 批准号: 1318529
• 负责人: Dianxiang Xu
• 金额: $ 49.98万
• 依托单位: Dakota State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-01 至 2013-10-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1318529&HistoricalAwards=false
• 关键词: TTP; Small; Automated; Conformance; Testing

Attributed-based obligatory access control is a new access control paradigm for achieving fine-grained authorization and assured system accountability. However, access control and obligation policies can be implemented incorrectly for various reasons, such as programming errors and misunderstanding about the policies. It is important to reveal discrepancy between the policy specification and the actual system implementation. The objective of this ?Transition To Practice? project is to develop an open source tool for model-based testing of attribute-based access control and obligation policies. It can build test models by integrating attribute-based access control and obligation rules with functional test models, generate test cases from the test models to meet given coverage criteria, and transform model-level test cases into executable code in a target language and test execution environment. The test code can then be executed with the system under test to exercise the access control and obligation policies. The tool is applicable to a great variety of systems due to the support for various programming languages and test execution environments. It is independent of how access control and obligation policies are implemented in the system under test. The broader impacts of this project include deployment of the tool to various academic and industry projects and involvement of students, particularly undergraduate students, in cutting-edge research.

基于属性的强制访问控制是一种新的访问控制范例，用于实现细粒度授权和有保证的系统责任。然而，访问控制和义务策略可能由于各种原因而无法正确实施，例如编程错误和对策略的误解。揭示政策规范与实际系统实施之间的差异非常重要。 “过渡到实践”的目标该项目旨在开发一个开源工具，用于基于模型的基于属性的访问控制和义务策略的测试。它可以通过将基于属性的访问控制和义务规则与功能测试模型集成来构建测试模型，从测试模型生成满足给定覆盖标准的测试用例，并将模型级测试用例转换为目标语言的可执行代码并测试执行环境。然后可以在被测系统上执行测试代码，以执行访问控制和义务策略。由于支持多种编程语言和测试执行环境，该工具适用于多种系统。它独立于被测系统中访问控制和义务策略的实施方式。该项目更广泛的影响包括将该工具部署到各种学术和行业项目中，以及学生（特别是本科生）参与前沿研究。