Currently, eXtensible Access Control Markup Language (XACML) has becoming the standard for implementing access control policies and consequently more attention is dedicated to testing the correctness of XACML policies. In particular, coverage measures can be adopted for assessing test strategy effectiveness in exercising the policy elements. This study introduces a set of XACML coverage criteria and describes the access control infrastructure, based on a monitor engine, enabling the coverage criterion selection and the on-line tracing of the testing activity. Examples of infrastructure usage and of assessment of different test strategies are provided.
In literature there are few works facing coverage assessment of XACML policies. Seminal works are presented in @cite_11 and @cite_0 . In the former, the authors provide a first coverage criterion for XACML policies defining three structural coverage metrics targeting XACML policies, rules and conditions respectively. These coverage metrics are used for reducing test sets and the effects of test reduction in terms of fault detection are measured. In the latter, the authors also address the policy set and do not require the policy execution and PDP instrumentation. The focus is in reducing the effort for coverage measurement focusing explicitly on the evaluation of the Rule Target Set. More recently, in @cite_12 the authors extend the introduced concept by presenting a combinatorial testing approach based on data flow coverage, while in @cite_6 the test execution information is used to determine which policy element is faulty. Specifically, the authors introduced the concept of reachability-based and firing-based fault localization techniques. In this paper, we extend the criteria proposed in @cite_0 differentiating the concept of Rule Target matching, so to better analyze the evaluation of policy rules.
@cite_0 @cite_6 @cite_12 @cite_11
2015012668 2418186419 2742459062 1556003781
XACML is the de facto standard for implementing access control policies. Testing the correctness of policies is a critical task. The test of XACML policies involves running requests and checking manually the correct response. It is therefore important to reduce the manual test effort by automatically selecting the most important requests to be tested. This paper introduces the XACML smart coverage selection approach, based on a proposed XACML policy coverage criterion. The approach is evaluated using mutation analysis and is compared on the one side with a not-reduced test suite, on the other with random and greedy optimal test selection approaches. We performed the evaluation on a set of six real world policies. The results show that our selection approach can reach good mutation scores, while significantly reducing the number of tests to be run. Access control policies in distributed systems, particularly implemented in the XACML standard language, are increasingly complex. Faults may exist in complex policies for various reasons such as misunderstanding of the access control requirements, omissions, and coding errors. These faults, if not removed before deployment, may lead to unauthorized accesses or denial of service. Manual localization of these faults, however, can be a challenging task. Inspired by spectrum-based fault localization for software debugging, this paper presents an approach for automatically localizing the fault(s) in a given XACML policy by exploring test coverage information of the policy elements. We investigate two test coverage criteria (i.e., reachability and firing) of policy elements and 14 scoring methods for ranking policy elements to determine the fault location(s). To evaluate the fault localization methods, we have used real-world policy files with different levels of complexity and a large number of policy mutants with one or two seeded faults. The experiment results show that the firing-based Naish2 and CBI-Inc methods are effective in fault localization of XACML policies. In this paper, the authors propose a new data flow based unit testing method. The authors involved the coverage selection approach with a decision inheritance tree, which can achieve high structural coverage to design test cases. The authors evaluate the effectiveness of the methods and conducted two sets of tests by using a series of mutation operators. The evaluation results show that the new method can reach higher mutation scores. To facilitate managing access control in a system, security officers increasingly write access control policies in specification languages such as XACML, and use a dedicated software component called a Policy Decision Point (PDP). To increase confidence on written policies, certain types of policy testing (often in an ad hoc way) are usually conducted, which probe the PDP with some typical requests and check PDP's responses against expected ones. This paper develops a first step toward systematic policy testing by defining and measuring policy coverage when testing policies. We have developed a coverage-measurement tool to measure policy coverage given a set of XACML policies and a set of requests. We have developed a tool for request generation, which randomly generates requests for a given set of policies, and a tool for request reduction, which greedily selects a nearly minimal set of requests for achieving the same coverage as the originally generated requests. To evaluate coverage-based request reduction and its effect on fault detection, we have conducted an experiment with mutation testing on a set of real policies. Our experimental results show that the coveragebased test reduction can substantially reduce the size of generated requests and incur only relatively low loss on fault detection. We also conduct a study on the policy coverage achieved by manually generated requests.