Warning: pg_query(): Query failed: ERROR: missing chunk number 0 for toast value 29512337 in pg_toast_2619 in /dati/webiit-old/includes/database.pgsql.inc on line 138 Warning: ERROR: missing chunk number 0 for toast value 29512337 in pg_toast_2619 query: SELECT data, created, headers, expire, serialized FROM cache_page WHERE cid = 'https://www-old.iit.cnr.it/node/24277' in /dati/webiit-old/includes/database.pgsql.inc on line 159 Warning: pg_query(): Query failed: ERROR: missing chunk number 0 for toast value 29512337 in pg_toast_2619 in /dati/webiit-old/includes/database.pgsql.inc on line 138 Warning: ERROR: missing chunk number 0 for toast value 29512337 in pg_toast_2619 query: SELECT data, created, headers, expire, serialized FROM cache_page WHERE cid = 'https://www-old.iit.cnr.it/node/24277' in /dati/webiit-old/includes/database.pgsql.inc on line 159 Testing of PolPA Authorization Systems | IIT - CNR - Istituto di Informatica e Telematica
IIT Home Page CNR Home Page

Testing of PolPA Authorization Systems

The implementation of an authorization system is a critical and error-prone activity that requires a careful verification and testing process.As a matter of fact, errors in the authorization system code could grant accesses that should instead be denied, thus jeopardizing the security of the protected system. In this paper, we address the testing of the implementation of the Policy Decision Point (PDP) within the PolPA authorization system that enables history-based and usage-based control of accesses. Accordingly, we propose two testing strategies specifically conceived for validating the history-based access control and the usage control functionalities of the PolPA PDP. The former is based on a fault model able to highlight the problems and vulnerabilities that could occur during the PDP implementation. The latter combines the standard technique for conditions coverage with a methodology for simulating the continuous control of the PDP during the runtime execution. Both strategies are implemented within a testing framework supporting the automatic generation and execution of security test suites. Results produced by the application of this testing framework to a real case study are presented.


Software Quality Journal, 2014

Autori esterni: Antonia Bertolino (ISTI - CNR), Said Daoudagh (ISTI - CNR), Francesca Lonetti (ISTI - CNR), Eda Marchetti (ISTI - CNR)
Autori IIT:

Tipo: Articoli su riviste ISI
Area di disciplina: Information Technology and Communication Systems
Da pagina 241 a pagina 271

Attività: Architetture, protocolli e meccanismi di sicurezza per sistemi e servizi distribuiti