Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

Security Testing: criteria, fault models and test generationResearch Staff : Yves Le Traon – Ph.D. Students : Tejeddine MouelhiKeywords : Security testing, security flaws, mutation analysis, test generation, security policyApplications : Information System SecurityPartners & Funding : : Tejeddine Mouelhi’s PhD thesis is co-advised with Benoit Baudry (INRIA-Rennes Bretagne Atlantique)IntroductionWhile important efforts are dedicated tosystem functional testing, very few worksstudy how to test specifically securitymechanisms implementing a security policy. Inthis thesis, we study how to adapt testingtechniques to test such security mechanisms.The testing techniques that have proven theireffectiveness in the field of functional testingare adapted in order to be applied to testsecurity mechanisms.RealizationWe applied mutation analysis to the context oftesting security policies [1]. The objective is tomake test cases efficient enough to revealerroneous implementations of a security policy.We adapted mutation analysis – which consistsof seeding security faults in the system –andproposed a fault model specific to accesscontrol security policies.Any security policy is strongly connected tosystem functionality: testing functions includesexercising many security mechanisms.However, testing functionality does not intendat putting to the test security aspects. Weproposed thus two strategies for producingsecurity policy test cases [2], depending if theyare built in complement of existing functionaltest cases or independently from them. Wealso proposed test selection criteria to producetests from a security policy. To quantify theeffectiveness of a set of test cases to detectsecurity policy flaws, we used mutationanalysis on three empirical studies. The overallapproach has been applied to OrBAC accesscontrol policies using the associated Motorbactool (http://www.orbac.org/).In collaboration with Alexander Pretschner,during its sabbatical at TELECOM Bretagne, webegan to study the test generation issue byproposing a new model-based approach thatuses combinatorial testing [3]. Test cases aregenerated using pair-wise testing and wecompare them to several random testgeneration. Mixed-feeling results show that wemust still study this problem.In the same collaboration, we also studied howto use security tests to detect hidden securitymechanisms in legacy systems [4]. In fact, ifaccess control policy decision points are notneatly separated from the business logic of asystem, the evolution of a security policy likelyleads to the necessity of changing the system’scode base. This is often the case with legacysystems. We analyzed the notion of flexibilitywhich is related to the presence of hidden andimplicit security mechanisms in the businesslogic. This first work suggested the use of atest-driven methodology to detect such hiddenmechanisms, and drive the incrementalevolution of a security policy.ConclusionAs a future work, we will focus on using metamodelsto offer a complete framework toproduce, in a generic way, a tool for mutationanalysis of interoperable security policies (firstresults in [5]). We will also study and proposenew approaches to automatically generatesecurity tests targeting the implementation ofsecurity policies.References[1] Mouelhi Tejeddine, Le Traon Yves, BaudryBenoit: Mutation analysis for security testsqualification. Mutation'07, third workshop onmutation analysist, September 10-11, CumberlandLodge, Windsor, UK, 2007.[2] Le Traon Yves, Mouelhi Tejeddine, BaudryBenoit: Testing security policies : going beyondfunctional testing. ISSRE'07: The 18th IEEEInternational Symposium on Software ReliabilityEngineering, November 5-9, Trollhätan, Sweden,2007.[3] Mouelhi Tejeddine, Le Traon Yves, PretschnerAlexander: Model-Based Tests for Access ControlPolicies. ICST 2008 : First IEEE InternationalConference on Software, Testing, Verification andValidation, April 9-11, Lillehammer, Norway, 2008.[4] Mouelhi Tejeddine, Le Traon Yves, PretschnerAlexander, Baudry Benoit: Test-Driven Assessmentof Access Control in Legacy Applications. ICST2008 : First IEEE International Conference onSoftware, Testing, Verification and Validation(ICST), April 9-11, Lillehammer, Norway, 2008.[5] Mouelhi Tejeddine, Fleurey Franck, BaudryBenoit: A Generic Metamodel For Security PoliciesMutation, SecTest 08: 1st International ICSTworkshop on Security Testing, April 9, Lillehammer,Norway, 2008.Rapport d’activités Pracom 2005-2006 - Department of Networks Security Multimedia - page n°35