SEKE 2012 Proceedings - Knowledge Systems Institute

Testing Interoperability Security Policies ∗
Mazen EL Maarabani 1 César Andrés 2 Ana Cavalli 1
1 TELECOM & Management SudParis
CNRS UMR Samovar, Evry, France
e-mail: {mazen.el maarabani, Ana.Cavalli}@it-sudparis.eu
2 Dpto de Sistemas Informáticos y Computación
Universidad Complutense de Madrid, Spain
e-mail: c.andres@fdi.ucm.es
Abstract
Testing is one of the most widely used techniques to increase
the quality and reliability of complex software systems.
In this paper we present the notion of testing interoperability
security rules in virtual organizations. In particular,
we incorporate mechanisms to test those interactions
among the organizations of the business communities when
the resources are shared. In order to apply our technique to
increase the confidence on the correctness of these systems,
we need to obtain a set of tests compiling the relevant properties
of the interoperability security policies. We present a
model based testing approach for checking the correctness
of these policies in this environment.
In addition to provide the theoretical framework, we
show how this formalism, based on extended finite automata,
has been used to test a hospital scenario. This exercise
convinced us that a formal approach to test systems
can facilitate some of the development phases. In particular,
how to choose which tests to apply, is simplified since
tests are automatically extracted from the specification.
Keywords: Integrity, Testing, Quality, Interoperability
Security Policy.
1. Introduction
Among those areas where the development of Computer
Science has changed our society during the last years, the
relevance of the collaboration among different information
systems is remarkable [2]. In particular, there is a strong
demand for access control of distributed shared resources
in Virtual Organizations, in short VO [8] where the classical
notion of client server architecture is obsolete and use-
∗ Research partially supported by the ISER project and the TESIS
project (TIN2009-14312-C02-01). The work was carried out while the
second author was visiting TELECOM SudParis.
less. In particular, a VO is composed of several organizations
and their employees, where they share some services
or resources among them. Cross-organizational interoperability
is a major challenge to VO applications [6]. To be
able to specify not only the functional aspect of a VO but
also those aspects that guarantee the interoperability security
policies is an industrial necessity [12]. Currently, we
cannot dissociate the functional aspect of a system from its
security consideration. Let us remark that security policies
restraint the behavior of a system in order to guarantee a certain
level of security. Moreover, it is possible that a security
policy adds new behaviors to the system such as obligation
actions in the case where these actions are not supported by
the system. Therefore, checking only the functional part of
a system is not sufficient to guarantee that a system behaves
as required and provides the intended services, this process
requires the application of sound techniques.
Formal methods refer to techniques based on mathematics
for the specification, development, and verification of
software and hardware systems. The use of formal methods
is especially important in reliable systems where, due to
safety and security reasons, it is important to ensure that errors
are not included during the development process. Formal
methods are particularly effective when used early in
the development process, at the requirements and specification
levels, but can be used for a completely formal development
of a system. One of the advantages of using a formal
representation of systems is that it allows to rigorously
analyze their properties. In particular, it helps to establish
the correctness of the system with respect to the specification
or the fulfillment of a specific set of requirements, to
check the semantic equivalence of two systems, to analyze
the preference of a system to another one with respect to a
given criterion, to predict the possibility of incorrect behaviors,
to establish the performance level of a system, etc. In
this line, formal testing techniques [10] can be used to test
the correctness of a system with respect to a specification.
464