Testing access control and obligation policies

As access control with obligatory constraints is critical to assuring system accountability, research on the specification and monitoring of obligation policy has gained increasing attention. However, a correctly specified obligation policy may be implemented incorrectly for various reasons, such as programming errors. This paper presents a model-based approach to testing access control and obligation policies. We build test models of access control and obligation policies based on system functions and derive tests from the models for exercising the system implementation. As a black box technique, our approach is independent of how access control and obligation requirements are implemented in the system under test. We demonstrate our approach through the testing of a real-world online banking system, which is being used by many financial organizations. The mutation analysis indicated that our testing approach is very effective.