Similarity testing for access control

•A new approach for access control test prioritization based on similarity.•Two XACML similarity metrics, one of them exploiting the XACML policy specification.•An empirical study that compares different techniques to prioritize XACML requests. Access control is among the most important security mec...

Full description

Saved in:
Bibliographic Details
Published in:Information and software technology 2015-02, Vol.58, p.355-372
Main Authors: Bertolino, Antonia, Daoudagh, Said, El Kateb, Donia, Henard, Christopher, Le Traon, Yves, Lonetti, Francesca, Marchetti, Eda, Mouelhi, Tejeddine, Papadakis, Mike
Format: Article
Language:English
Subjects:
Access control
Computer information security
Computer programs
Criteria
Effectiveness studies
Extensible Markup Language
Fault detection
Fault diagnosis
Mutations
Policies
Priorities
Security management
Security policies
Similarity
Test prioritization
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:•A new approach for access control test prioritization based on similarity.•Two XACML similarity metrics, one of them exploiting the XACML policy specification.•An empirical study that compares different techniques to prioritize XACML requests. Access control is among the most important security mechanisms, and XACML is the de facto standard for specifying, storing and deploying access control policies. Since it is critical that enforced policies are correct, policy testing must be performed in an effective way to identify potential security flaws and bugs. In practice, exhaustive testing is impossible due to budget constraints. Therefore the tests need to be prioritized so that resources are focused on their most relevant subset. This paper tackles the issue of access control test prioritization. It proposes a new approach for access control test prioritization that relies on similarity. The approach has been applied to several policies and the results have been compared to random prioritization (as a baseline). To assess the different prioritization criteria, we use mutation analysis and compute the mutation scores reached by each criterion. This helps assessing the rate of fault detection. The empirical results indicate that our proposed approach is effective and its rate of fault detection is higher than that of random prioritization. We conclude that prioritization of access control test cases can be usefully based on similarity criteria.
ISSN:0950-5849
1873-6025
DOI:10.1016/j.infsof.2014.07.003