TTP: Small: Automated Conformance Testing of Access Control and Obligation Policies

TTP：小：访问控制和义务策略的自动一致性测试

基本信息

批准号：
1359590
负责人：
Dianxiang Xu
金额：
$ 49.98万
依托单位：
Boise State University
依托单位国家：
美国
项目类别：
Standard Grant
财政年份：
2013
资助国家：
美国
起止时间：
2013-09-01 至 2017-08-31
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=1359590&HistoricalAwards=false
关键词：
TTP Small Automated Conformance Testing

项目摘要

Attributed-based obligatory access control is a new access control paradigm for achieving fine-grained authorization and assured system accountability. However, access control and obligation policies can be implemented incorrectly for various reasons, such as programming errors and misunderstanding about the policies. It is important to reveal discrepancy between the policy specification and the actual system implementation. The objective of this ?Transition To Practice? project is to develop an open source tool for model-based testing of attribute-based access control and obligation policies. It can build test models by integrating attribute-based access control and obligation rules with functional test models, generate test cases from the test models to meet given coverage criteria, and transform model-level test cases into executable code in a target language and test execution environment. The test code can then be executed with the system under test to exercise the access control and obligation policies. The tool is applicable to a great variety of systems due to the support for various programming languages and test execution environments. It is independent of how access control and obligation policies are implemented in the system under test. The broader impacts of this project include deployment of the tool to various academic and industry projects and involvement of students, particularly undergraduate students, in cutting-edge research.

基于归因的强制性访问控制是一种新的访问控制范例，用于实现细粒度的授权和确保系统责任。但是，出于各种原因，可以错误地实施访问控制和义务政策，例如编程错误和对政策的误解。重要的是要揭示策略规范与实际系统实施之间的差异。这个目标是？过渡到实践？项目是为基于属性的访问控制和义务策略的基于模型测试的开源工具开发开源工具。它可以通过将基于属性的访问控制和义务规则与功能测试模型集成，从测试模型中生成测试案例以满足给定的覆盖标准，并将模型级测试用例转换为目标语言中的可执行代码和测试执行环境，从而构建测试模型。然后，可以使用正在测试的系统执行测试代码以行使访问控制和义务策略。由于支持各种编程语言和测试执行环境，该工具适用于各种系统。它独立于在测试系统中如何实施访问控制和义务策略。该项目的更广泛的影响包括将工具部署到各种学术和行业项目中，以及学生，特别是本科生的参与。