Scalable and Effective Test Generation for Access Control Systems
Download
1 / 61

Scalable and Effective Test Generation for Access Control Systems - PowerPoint PPT Presentation


  • 51 Views
  • Uploaded on

Scalable and Effective Test Generation for Access Control Systems. Ammar Masood School of Electrical & Computer Engineering Purdue University 11 th September, 2006. Outline. Introduction Problems and Contributions – Part A Details of Proposed Solutions – Part B Conclusion and Future Work.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Scalable and Effective Test Generation for Access Control Systems' - illana-wong


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Scalable and Effective Test Generation for Access Control Systems

Ammar Masood

School of Electrical & Computer Engineering

Purdue University

11th September, 2006

1


Outline
Outline Systems

  • Introduction

  • Problems and Contributions – Part A

  • Details of Proposed Solutions – Part B

  • Conclusion and Future Work

2


Motivation and challenges
Motivation and Challenges Systems

  • Protection of information from unauthorized access or modification and protection against denial of service to authorized users is an important security requirement

  • Access control is one of the key security service providing the support for secure information access

  • Desired access control objectives only achieved if the underlying implementation conforms to the policy, hence testing becomes essential

  • Key challenge: how to devise scalable and effective test generation techniques ?

3


Requirement for testing
Requirement for Testing Systems

  • A number of vulnerabilities are related to design and/or coding flaws in access control modules of an application*

    • OSVDB reports 53 vulnerabilities related to access control

    • NVD which records CVE and CERT advisories reports 859 vulnerabilities with impact “provides unauthorized access” and type “access validation error”, 1440 for any impact

    • Security Focus reports 80 vulnerabilities for the key word “access control”

  • Formal verification and static or dynamic program-analysis techniques only guarantee correctness of design

    • Testing is required to detect any faults in the implementation due to, for example, coding errors and incorrect configuration

*Data as of 8/30/06

4



Testing context
Testing Context Systems

6


Role based access control rbac and temporal rbac

RBAC is a promising approach for addressing diverse security needs of business organizations

Access control in organizations is based on “roles that individual users take on as part of the organization”

A role is “is a collection of permissions”

Constraints are applied to all the links

Role Based Access Control (RBAC) and Temporal RBAC

TRBAC extends RBAC by imposing duration constraints on user-role assignments/activations and permission-role assignments

7


Outline1
Outline needs of business organizations

  • Introduction

  • Problems and Contributions – Part A

  • Details of Proposed Solutions – Part B

  • Conclusion and Future Work

8


Contributions
Contributions needs of business organizations

  • RBAC fault model

  • Test generation for RBAC Systems

  • A Probabilistic model for fault coverage

  • An empirical evaluation

  • Test generation for TRBAC Systems

    • Behavior modeling of TRBAC systems

    • TRBAC conformance testing

9


1 rbac fault model
1. RBAC Fault Model needs of business organizations

  • Required to study fault coverage of any test generation technique

  • Proposed fault model comprises

    • Mutation-based (simple) faults

    • Non-mutation (malicious) faults

  • Behavioral conformance used to study the fault model

10


2 test generation for rbac systems
2. Test Generation for RBAC Systems needs of business organizations

  • Requirements :-

    • Effectiveness – fault detection effectiveness measured with respect to RBAC fault model

    • Scalability – the cost of test generation and execution

  • Existing research – Chandarmouli and Blackburn functional testing technique for Discretionary Access Control

    • Effectiveness not considered

    • Not amenable for fault coverage analysis

11


Proposed solution
Proposed Solution needs of business organizations

  • Set of conformance testing procedures with varying cost and effectiveness

    • Procedure A : Complete-FSM based

    • Procedure B : Heuristics based

    • Procedure C : Constrained Random Test Selection (CRTS) strategy based

  • Procedure A is most effective – complete fault coverage for simple faults and a class of malicious faults – and most costly

  • Cost and effectiveness of Procedures B and C varies with the heuristic considered for test generation and the length of test cases in the CRTS suite

12


Proposed solution continued
Proposed Solution (continued) needs of business organizations

  • Functional Testing

    • Required to ensure that ACUT conforms to all RBAC policies

    • Proposed methodology is based on policy meta test set

    • White box coverage criteria used as a feed back mechanism to establish correctness of ACUT functionality

  • The functional testing technique is generic in that it can be used for TRBAC systems

13


3 a probabilistic model for fault coverage
3. A Probabilistic Model for Fault Coverage needs of business organizations

  • Requirement

    • A mechanism for analytically comparing fault coverage of heuristics and CRTS strategy based test generation techniques

  • Existing research

    • Petrenko et. al. use mutation based approach to access fault coverage of tests for FSM’s

    • One-to-one relation between faults and structural mutants

    • Not suitable for our analysis because of many-to-many relation between RBAC/TRBAC faults and structural mutants

14


Proposed approach
Proposed Approach needs of business organizations

  • Coverage matrix used to model relation between FSM and RBAC faults

  • Faults exhibited randomly across the FSM transitions

  • Fault coverage analytically studied for two general cases of fault distribution (uniform and non-uniform)

  • Simulation:- To study fault coverage of test generation techniques for fault distributions achieved as mix of uniform and non-uniform distributions

    • High coverage of all techniques for uniform case

    • Coverage drops as distribution limits to complete non-uniform case

    • Coverage directly proportional to the number of transitions in the test suite

15


4 empirical evaluation
4. Empirical Evaluation needs of business organizations

  • To study cost and effectiveness of use of all the procedures in functional testing of an RBAC system

  • Based on X-GTRBAC prototype system

    • X-GTRBAC consists of

      • Policy initializer

      • Policy enforcer (ACUT)

  • Fault detection effectivenessmeasured through program mutation and manual injection of malicious faults

    • Program mutants manually associated with RBAC faults (simple faults)

  • Cost measured in terms of total number of state queries performed in the execution of a test suite

16


Results
Results needs of business organizations

  • Procedure A most effective and most costly

  • Heuristics and CRTS strategy perform equally well for simple faults but heuristics lag CRTS strategy in detecting malicious faults

  • Effectiveness of CRTS increases as length of tests included in the suite increases, cost also increases but is significantly less then that of Procedure A

  • Reasons:

    • Heuristics by design fail to consider a holistic view of the system

    • Simple faults are exhibited across much higher number of transitions as compared to malicious faults, thus easier to detect

    • CRTS randomly select paths of fixed length from complete FSM, thus as length of tests increases there are more chances of inclusion of higher length paths in the CRTS test suite

17


Recommendations to practitioner
Recommendations to Practitioner needs of business organizations

  • Although only Procedure A provides complete fault coverage it could be prohibitively expensive

    • CRTS strategy provides the balance between cost and effectiveness

  • Reaffirmation of usefulness of white-box criteria to enhance tests generated using black-box approach

    • Malicious faults likely to be missed easily by the heuristics

    • As exhaustive testing not a viable option, functional testing requires white-box criteria as a feed back mechanism to determine the stopping point

18


Comparison with simulation results
Comparison with Simulation Results needs of business organizations

  • Fault coverage results for the case of uniform fault distribution in the simulation are close to case study results for simple faults

    • Given a test generation technique, the analytic result of fault coverage for uniform fault distribution may be used as a predictor of its effectiveness in detecting simple faults

  • Wide disparity between coverage results for the simulation and for the case study for malicious faults

    • Logical result as malicious faults are injected with malicious intent, thus can not be modeled with uniform distribution

19


5 test generation for trbac systems
5. Test Generation for TRBAC Systems needs of business organizations

  • Require effective and scalable test generation technique

    • How to measure effectiveness?

      • TRBAC fault model (extensions in RBAC fault model)

    • Scalability ?

      • Determined by the size of the test suite (size of model)

  • Why can’t existing approaches for test generation be directly used for TRBAC test generation?

    • Techniques for RBAC system not usable as simple FSM’s cannot capture real-time considerations

      • Solution – use Timed Input Output Automata (TIOA) to model TRBAC

    • TIOA based test generation techniques

      • Symbolic clustering of states – scalable but effectiveness not measurable

      • State characterization set based (Timed-Wp method) – effective but not at all scalable

      • TIOA transformation to FSM (se-FSA based) – effective and scalable

20


Proposed approach1
Proposed Approach needs of business organizations

21


Behavior modeling of trbac systems
Behavior modeling of TRBAC systems needs of business organizations

  • Requirement

    • Model correctly specify the behavior implied by the TRBAC specification

  • TRBAC model (TRBACM) is based on TIOA

  • Two options in constructing TRBACM

    • Construct a single monolithic model

    • Divide the system into parts – compositional construction

  • TRBACM= URM || PRM

  • TRBACM is proved to correctly model the TRBAC specification

22


Trbac conformance testing
TRBAC conformance testing needs of business organizations

  • Key steps

    • Transformation of TRBACM into se-FSA

    • Constructing the test tree corresponding to the se-TRBACM

    • Use of an Integer Programming (IP) based approach to generate the conformance test suite

  • Fault detection effectiveness

    • Provides complete fault coverage by virtue of correctness of TRBACMand the correlation between TRBAC, TIOA and se-FSA faults

  • Heuristics can be used to reduce the model size and thus the size of the corresponding test suite

    • May result into reduced fault detection effectiveness, can be analytically studied for cases of fault distribution using the probabilistic model

23


Outline2
Outline needs of business organizations

  • Introduction

  • Problems and Contributions – Part A

  • Details of Proposed Solutions – Part B

  • Conclusion and Future Work

24


Conformance relation
Conformance Relation needs of business organizations

  • Based on behavioral conformance

  • Specified using the two conditions, which informally imply that ACUT

    • assigns (deassigns) and activates (deactivates) a role only if such assignment (deassignment) and activation (deactivation) is allowable by the current policy in effect

    • assigns (deassigns) a set of permissions to (from) a role only if allowable by the current policy in effect

    • ignores ill-formed requests

25


Rbac fault model
RBAC Fault Model needs of business organizations

  • Conformance between ACUT and ACUT implies absence of any faults in the ACUT i.e. faults in P

    • Conformance testing of ACUT can thus be considered as verifying that P does not belong to set of faulty policies

  • RBAC fault model defines the set of faulty policies

    • Obtained using mutation based approach [Petrenko et.al.]

    • Three types of operators used for mutating the elements of RBACP

      • Set mutation operators

      • Element modification operators

      • Rule mutation operators

26


Malicious faults
Malicious Faults needs of business organizations

  • Counter based

    • A specific count of events leads to fault

  • I/O based

    • Faults based on malformed requests

  • Sequence-based

    • A specific sequence of events leads to fault

27


Conformance testing procedures
Conformance Testing Procedures needs of business organizations

  • Behavior implied by a policy expressed as an FSM.

  • Heuristics applied to scale down the model.

  • Use the W-method, or its variant, to generate tests from the complete (Procedure A) or scaled down model (Procedure B) or randomly select paths of fixed length from the completemodel (Procedure C)

28


Sample fsm

0000 needs of business organizations

DS11

DS21

AS21

AS11

DS21

DS11

1000

0010

DS11

AS21

AC21

AS11

DS21

AC11

DC11

DS21

DC21

DS11

1100

1010

0011

DS21

DS11

AC21

DC21

AC11

DC11

AS21

AS11

1110

1011

Sample FSM

Two users, one role. Only one user can activate the role.

Number of states≤32.

AS: assign. DS: De-assign. AC: activate. DC: deactivate.

Xij: do X for user i role j.

29


Heuristics
Heuristics needs of business organizations

H1: Separate assignment and activation

H2: Use FSM for activation and single test sequence for assignment

H3: Use single test sequence for assignment and activation

H4: Use a separate FSM for each user

H5: Use a separate FSM for each role

H6: Create user groups for FSM modeling.

30


Reduced models

00 needs of business organizations

00

AS11

AC11

AC21

DS11

DS21

DC11

DC21

DS21

DS11

AC21

AC11

10

10

AS21

01

01

11

AC21

00

AC11

00

AS21

AS11

DS21

DS21

DS11

DS11

AC21

AC11

10

11

10

11

DC21

DC11

Reduced Models

Assignment Machine

Activation Machine

Heuristic 1

User u1 Machine

User u2 Machine

Heuristic 4

31


Procedure c crts strategy
Procedure C: CRTS Strategy needs of business organizations

  • Constructs a pool RTi of n random tests.

    • Lengths of all tests in the pool RTi is same, i.e. i which is selected to be comparable with the length of longest test generated using Procedure A

    • The total number of tests n is selected based on comparison with the maximum number of tests generated using the heuristics (Procedure B)

  • Construct five test suites RTi1,…., RTi5 by randomly selecting fixed number p of tests from RTi

    • p empirically chosen based on economical or statistical criterion

32


Probabilistic model for fault coverage
Probabilistic Model for Fault Coverage needs of business organizations

  • State observability assumed

  • Based on Coverage matrixCx, x {H0, H1,…, RTi}

  • Visibility of faults among transitions is given by x=b. Cx where b is a identity row vector of length j

  • Fault Coverage (FCx) is computed as

    where

33


Boundary cases of fault distribution
Boundary Cases of Fault Distribution needs of business organizations

  • |F|=j=|TH0|, such that one-to-one correspondence between faults and transitions, FCx= # of transitions in x/j

    • If x1 covers more transitions then x2 FCx1 > FCx2

  • Single fault f with equal probability of being exhibited across any transition t TH0

    • Fault coverage of x is now the probability of detecting f using x

34


General cases of fault distribution
General Cases of Fault Distribution needs of business organizations

  • Case A: The total number of transition across which each fault f is exhibited is uniformly distributed

  • Case B: Total number of faults is more than 1, each fault f has equal probability of being exhibited across any transition t TH0

35


Simulation
Simulation needs of business organizations

  • Five cases of fault distribution

    • Cases 0 and 4 – same as Cases A and B

    • Cases 1, 2 and 3 – respectively correspond to cases in which 75%, 50% and 25% of faults are uniformly exhibited (as per Case 0) rest as per Case 4

  • Metrics used for comparison of testing generation techniques

    • Average fraction of faults detected

    • Probability of detecting all faults p(F)

  • Setup

    • 10,000 iterations

    • 5 values of fault density 0.01, 0.05, 0.1, 0.2 and 0.5

36


Results average fraction of faults detected
Results : Average fraction of Faults Detected needs of business organizations

  • Common trend for all cases of fault distribution

    • Expected as faults are independently and identically exhibited

  • High coverage for all techniques for Case 0

    • As fault distribution limits to Case 4, coverage reduces dramatically for techniques with less number of transitions in their test suites

37


Results probability of detection of all faults
Results : Probability of Detection of all Faults needs of business organizations

  • p(F) reduces considerably with increase in fault density

    • Expected as p(F) is the product of probabilities for detection of individual faults

    • As fault distribution limits to Case 4, the exponential term in p(F) corresponding to Case 4 dominates

  • No test generation technique other than the complete FSM based, provides guarantee of detecting all faults

    • Solution – use white box adequacy criteria for test enhancement

38


39 needs of business organizations


Empirical evaluation setup
Empirical Evaluation : Setup needs of business organizations

  • Study carried out using the proposed functional testing methodology

    • Stopping criterion – complete coverage of simple faults

    • Policy meta set – comprises two policies

    • Meta test sets – corresponding to the three procedures

  • Test generation techniques used

    • H3, H4 and H5 heuristics

    • RT4, RT6, RT10 and RT100

    • 100 tests in each test suite RTij

40


Empirical evaluation results
Empirical Evaluation : Results needs of business organizations

41


Empirical evaluation and simulation results comparison
Empirical Evaluation and Simulation Results Comparison needs of business organizations

42


Trbac fault model
TRBAC Fault Model needs of business organizations

  • Conformance relation similar to the one for RBAC systems

    • Addition of a condition to consider temporal conformance

  • RBAC fault model extended by changing the application of rule mutation operator, result is addition of three temporal faults

43


Timed input output automata tioa
Timed Input Output Automata (TIOA) needs of business organizations

44


Trbac modeling

?AC(u needs of business organizations1,r1,t2)

L0

L0 URassign(u1,r1)=0, URactive(u1,r1)=0

L1 URassign(u1,r1)=1, URactive(u1,r1)=0

L2 URassign(u1,r1)=1, URassign(u1,r1)=1

x1=t1

!DS(u1,r1)

x1=t1

!DS(u1,r1)

?AS(u1,r1,t1)

x1:=0

L1

L2

x2=t2

!DC(u1,r1)

?AC(u1,r1,t2)

x2:=0

TRBAC Modeling

  • TRBACM= URM || PRM

  • URM=URb1 ||ur URb2 ||ur, …,||ur URbk , three types of URb’s corresponding to user-role (UR) pairs with

    • Explicit assignment information

    • No explicit assignment and implicit activation

    • No explicit assignment but implicit activation

45


Trbac modeling continued
TRBAC Modeling (continued) needs of business organizations

  • PRM=PRb1 ||pr PRb2 ||pr, …,||pr PRbk , two types of PRb’s corresponding to permission-role (PR) pairs with

    • Explicit assignment information

    • No explicit and implicit assignment

  • Example: Three permissions p1, p2and p3 , three roles r1, r2 and r3, r2 I r3

    • p2r1 , p3r1 and p1r2 explicit assignment

46


Sample trbac m
Sample TRBAC needs of business organizationsM

  • Example policy with a user u1 two roles {r1, r2}

    • Constraint: u1 cannot be simultaneously assigned to both roles

    • No permissions considered thus TRBACM= URb(u1,r1) ||ur URb(u1,r2)

47


Se fsa transformation khoumsi

?AS(u needs of business organizations1,r1),

Set(x1,4)

?AC(u1,r1,t2)

0<x1<4

x1<x2

0<x1

0<x2

4<x1

x1<x2

0<x1<4

0<x2<2

4<x1

0<x2<2

0<x1<4

2<x2

4<x1

2<x2

l1

l0

l0

l1

l0

l2

l0

t1=4 and t2=2

-

-

2<x2-x1<4

0<x1-x2<4

2<x1-x2<4

-

-

L0

Exp(x1,4),

!DS(u1,r1)

?AS(u1,r1),

Set(x1,4)

x1=t1

!DS(u1,r1)

x1=t1

!DS(u1,r1)

q2

q0

q1

?AS(u1,r1,t1)

x1:=0

?AC(u1,r1),

Set(x2,2)

Exp(x2,2),

!DC(u1,r1)

L1

L2

Exp(x2,2),?AS(u1,r1), Set(x1,4)

x2=t2

!DC(u1,r1)

q3

q4

Exp(x1,4),

!DS(u1,r1)

Exp(x1,4),

!DS(u1,r1)

?AC(u1,r1,t2)

x2:=0

se-FSA

q5

Exp(x1,4), Exp (x2,2) !DS(u1,r1)

Exp(x2,2)

q6

se-FSA Transformation [Khoumsi]

  • Three types of events

    • Input events – input actions and/or clock resets

    • Output events – output actions and/or clock expirations

    • Complex events – mix of above two

48


Test generation from se trbac m
Test Generation From se-TRBAC needs of business organizationsM

  • se-TRBACMdeterministic and finite state

    • W-method can thus be used for test generation

    • Assumed location observability – tests constructed from test tree (Tr)

    • Tr constructed so that all terminals correspond to accepting states of se-TRBACM

  • Tr represents paths in se-TRBACM,

    • Given a path pt in Tr, A test sequence is constructed by associating all edges ept with monotonically increasing time stamps

    • Temporal constraints determined by the Set and Exp events along edges of pt

49


How to construct a test sequence

p needs of business organizationst1

How to Construct a Test Sequence?

  • Corresponding to pathpt1

  • The temporal constraints can be represented as

  • Formulate as an IP to control the minimum resolution dti

  • For k=0.1 the solution would be

  • Conformance Test Suite (CTS) constructed by finding feasible time stamps for all test sequences

50


How to apply a test sequence

Set(c,k) needs of business organizations

Test-Controller

Clock-Handler

Exp(c,k)

Test System

State query

output

input

State info

ACUT

How to Apply a Test Sequence ?

  • Used the architecture proposed by Khoumsi

  • Given a test sequence, following semantics considered for time stamps associated with:

    • Inputs – time at which Test-Controller should generate the corresponding input for the ACUT and the Clock-Handler

    • Outputs – ACUT will pass the given sequence if outputs by the ACUT and Clock-Handler and the states match

51


Fault coverage of cts

TRBAC needs of business organizations

FM

correlated with

TIOA

FM

correlated with

se-FSA

FM

Fault Coverage of CTS

  • Determined using the relation between TRBAC, TIOA and se-FSA fault models (FM)

  • Output, Transfer, missing and extra location faults in TIOA FMhave similar representation in se-FSA

  • Time constraint restriction/widening faults – output/transfer faults

  • Clock reset faults not directly comparable – shown to be detectable by CTS

  • Implies CTS detects all TRBAC Faults

52


Conclusion
Conclusion needs of business organizations

  • Proposed a unified framework for scalable and effective conformance and functional testing of RBAC and TRBAC systems

    • Effectiveness studied using the proposed RBAC and TRBAC fault models

    • Scalability achieved using proposed conformance testing procedures with varying cost

  • Proposed a probabilistic model for fault coverage to analytically evaluate fault detection effectiveness of proposed conformance test generation techniques for various cases of fault distribution

  • Performed an empirical study to evaluate the cost and effectiveness of proposed procedures in functional testing of a prototype RBAC system

53


Future work
Future Work needs of business organizations

  • Test generation for TRBAC systems

    • Extending the temporal constraints in TRBAC specification

    • Extension of TRBC fault model

    • Conducting an empirical evaluation

  • Validation of global meta-policy in collaborative environments

  • Regression testing techniques for access control systems

54


Backup Slides needs of business organizations

55


Advantages of rbac
Advantages of RBAC needs of business organizations

  • Allows efficient security management through role hierarchy and administrative roles

  • Principle of least privilege allows minimizing damage due to misuse of privilege

  • Separation of duty constraints prevent fraud

    • Role specific SoD constraint disallows conflicting roles to be accessed by same user

    • User specific SoD constraint disallows conflicting user to access same role

  • Encompasses traditional discretionary and mandatory policies

56


Functional testing methodology
Functional Testing Methodology needs of business organizations

57


Many to many relation between rbac and fsm faults

0000 needs of business organizations

transfer fault

0000

AS21

AS11

A transfer fault

AS11

DS21

0010

0010

AS11

transfer fault

f1: UR1 fault

UR1 and UR2 faults

Many-to-Many Relation between RBAC and FSM faults

58


Behavioral conformance
Behavioral Conformance needs of business organizations

59


Rbac fault model simple faults
RBAC Fault Model – Simple Faults needs of business organizations

Relation between FSM and RBAC Fault Model

60


Fault coverage of h4 for boundary case 1

t needs of business organizations3

0000

DS11

DS21

t6

t1

AS21

t4

AS11

t7

DS21

t9

DS11

1000

0010

DS11

t2

AS21

AC21

AS11

DS21

t5

AC11

DC11

DS21

DC21

DS11

t10

t8

1100

1010

0011

DS21

DS11

AC21

DC21

AC11

DC11

AS21

AS11

1110

1011

00

00

t4

t6

t1

t3

AS21

AS11

DS21

DS21

DS11

DS11

t7

t9

t2

t5

AC21

AC11

10

11

10

11

t8

DC21

t10

DC11

Fault Coverage of H4 for Boundary Case 1

FSM(P)

H4: Mu1 and Mu2

61


ad