With the explosive growth of the Internet, the Attribute-Based Access Control (ABAC) System has developed rapidly in size and complexity. So it is important to identify potential security flaws and bugs in the ABAC System using efficient testing. However, exhaustive testing is unrealistic due to time and budget constraints. In this paper, we propose a new method of unit testing based on the coverage selection approach using a decision inheritance tree. This data flow based testing method can achieve high structural coverage of design test cases. To evaluate the effectiveness of this method, we conducted two sets of tests using mutation operators and found higher mutation scores using the coverage selection approach based on the decision inheritance tree and combination testing based on data flow. The evaluation results show that the new method can reach higher mutation scores.
ShenH.-B. and HongF., An Attribute-Based Access Control Model for Web Services, Taipei, pp, Seventh International Conference on Parallel and Distributed Computing, Applications and Technologies (2006), 74–79.
2.
eXtensible Access Control Markup Language (XACML) Version 3.0 core specification, 2015–http://docs.oasisopen.org/xacml/3.0/xacml-3.0-core-spec-cos01-en.Pdf.
3.
Richard KuhnD. and OkunV., Psuedo-exhaustive testing for software, In pp, 30th NASA/IEEE Software Engineering Workshop (2006), 153–158.
4.
FislerK., KrishnamurthiS., MeyerovichL.A. and TschantzM.C., Verification and Change-impact Analysis of Access-control Policies, St. Louis, Missouri, USA, pp. , 27th International Conference on Software Engineering (2005), 196–205.
5.
KolovskiV. and HendlerJ., and Parsia, Analyzing web Access Control Policies, Banff, Alberta, Canada, pp, The International World Wide Web Conference Committee (IW3C2) (2007), 677–686.
6.
YuT., SivasubramanianD. and XieT., Security Policy Testing via Automated Program Code Generation, Oak Ridge, Tennessee, USA, pp, 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and Strategies (2009), 13–16.
7.
LaskiJ.W. and KorelB., A data flow oriented program testing strategy, IEEE Transactions on Software EngineeringSE93(3) (1983), 347–354.
8.
ZhangY. and ZhangB., A New Testing Method for XACML 3.0 Policy Based on ABAC and Data Flow, Ohrid, Macedonia, The IEEE 11th International Conference on Control and Automation (ICCA 2017).2017.
9.
RothermelG., UntchR., ChuC. and HarroldM.J., Prioritizing test cases for regression testing, IEEE Transactions on Software Engineering27(10) (2001), 929–948.
10.
LiZ., HarmanM. and HieronsR.M., Search algorithms for regression test case prioritization, IEEE Transactions on Software Engineering33(4) (2007), 225–237.
11.
ZhangY., ZhangB. and WangZ., Research of a Data Flow Test Method for Attribute-based Access Control Systems, Shanghai, China, The 3rd Annual International Conference on Network and Information Systems for Computers.2017.
12.
Leon-SalasW.D. and PodgurskiA., A Comparison of Coverage-based and Distribution-based Techniques for Filtering and Prioritizing Test Cases,Denver, Colorado, pp, 14th International Symposium on Software Reliability Engineering (ISSRE’03) (2003), 442–453.
13.
BertolinoA., TraonY.L., LonettiF., MarchettiE. and MouelhiT., Coverage-based Test Cases Selection for XACML Policies, Cleveland, OH, USA, pp, 2014 IEEE Seventh International Conference on Software Testing, Verification and Validation Workshops (ICSTW) (2014), 12–21.
14.
GrindalM., OffuttJ. and AndlerS.F., Combination testing strategies: A survey, software: Testing, Verification and Reliability15(3) (2005), 167–199.
15.
MartinE., XieT. and TingY., Defining and Measuring Policy Coverage in Testing Access Control Policies, Raleigh, NC, USA, pp. , 8th International Conference on Information and Communications Security (ICICS’06) (2006), 139–158.
16.
MartinE. and XieT., A Fault Model and Mutation Testing of Access Control Policies, Banff, Alberta, Canada, pp, The International World Wide Web Conference Committee (IW3C2) (2007), 667–676.
17.
BertolinoA., DaoudaghS., LonettiF. and MarchettiE., XACMUT: XACML 2.0 Mutants Generator, Luxembourg, Luxembourg, pp, 2013 IEEE Sixth International Conference on Software Testing, Verification and Validation Workshops (ICSTW) (2013), 28–33.
18.
BertolinoA., DaoudaghS. and LonettiF., et al. The X-CREATE Framework: A Comparison of XACML Policy Testing Strategies, Portugal, pp. , 8th International Conference on Web Information Systems and Technologies (2012), 155–160.
19.
LiY., LiY., WangL., et al., Automatic XACML Requests Generation for Testing Access Control Policies, Montreal pp, 2012 IEEE Fifth International Conference on Software Testing, Verification and Validation (2012), 217–222.Montreal, Canada.
20.
PretschnerA., MouelhiT. and TraonY.L., Model-based Tests for Access Control Policies, pp, 2008 IEEE 1st International Conference on Software Testing, Verification, and Validation (2008), 338–347.
21.
XuD., ThomasL., KentM., et al., A Model-based Approach to Automated Testing of Access Control Policies, Newark, New Jersey, USA, pp, 17th ACM symposium on Access Control Models and Technologies (2012), 209–218.
22.
HwangJ., XieT., KatebD.E., MouelhiT. and TraonY.L., Selection of Regression System Tests for Security Policy Evolution, Germany, Essen, pp, The 27th IEEE/ACM International Conference on Automated Software Engineering (2012), 266–269.
23.
MartinE., Testing and Analysis of Access Control Policies, pp, The IEEE 29th International Conference on Software Engineering. IEEE Computer Society (2007), 75–76.
24.
WaheedS.Z. and QamarU., Data Flow Based Test Case Generation Algorithm for Object Oriented Integration Testing, Beijing, China, pp, IEEE International Conference on Software Engineering and Service Science IEEE (2015), 423–427.
25.
GirgisM.R., GhidukA.S. and Abd-ElkawyE.H., Automatic data flow test paths generation using the genetical swarm optimization technique, International Journal of Computer Applications116(22) (2015), 25–33.
26.
GirgisM.R., GhidukA.S. and Abd-ElkawyE.H., Automatic generation of data flow test paths using a genetic algorithm, International Journal of Computer Applications8912 (2014), 29–36.
27.
LiA. and ZhangY., Automatic Generating All-path Test Data of a Program Based on PSO, Xiamen, China, pp, WCSE ’09. WRI World Congress on Software Engineering (2009), 189–193.
28.
DenaroG., MargaraA., PezzeM., et al., Dynamic Data Flow Testing of Object Oriented Systems, Florence, Italy, pp, IEEE International Conference on Software Engineering (2015), 947–958.
29.
JiS., LiB. and ZhangP., Test Case Selection for Data Flow Based Regression Testing of BPEL Composite Services, CA, USA, pp, IEEE International Conference on Services Computing San Francisco (2016), 547–554.
30.
KumarS., YadavD.K. and KhanD.A., Artificial bee colony based test data generation for data-flow testing, Indian Journal of Science & Technology9(39) (2016), 1–10.
