Skip to main content
Article
Detecting Incorrect Uses of Combining Algorithms in XACML 3.0 Policies
International Journal of Software Engineering and Knowledge Engineering
  • Dianxiang Xu, Boise State University
  • Ning Shen, Boise State University
  • Yunpeng Zhang, Boise State University
Document Type
Article
Publication Date
11-1-2015
Disciplines
Abstract
With the increasing complexity of software, new access control methods have emerged to deal with attribute-based authorization. As a standard language for specifying attribute-based access control policies, XACML offers a number of rule and policy combining algorithms to meet different needs of policy composition. Due to their variety and complexity, however, it is not uncommon to apply combining algorithms incorrectly, which can lead to unauthorized access or denial of service. To solve this problem, this paper presents a fault-based testing approach for revealing incorrect combining algorithms in XACML 3.0 policies. The theoretical foundation of this approach relies on the formalization of semantic differences between rule combining algorithms and between policy combining algorithms. It allows the use of a constraint solver for generating queries to which a given policy produces different responses than its combining algorithm-based mutants. Such queries can determine whether or not the given combining algorithm is used correctly. Our empirical studies using various XACML policies have demonstrated that our approach is effective.
Citation Information
Dianxiang Xu, Ning Shen and Yunpeng Zhang. "Detecting Incorrect Uses of Combining Algorithms in XACML 3.0 Policies" International Journal of Software Engineering and Knowledge Engineering (2015)
Available at: http://works.bepress.com/dianxiang_xu/22/