The document discusses testing delegation policies through mutation analysis. It provides background on access control and delegation. Formal definitions are given for access control policy, master-level delegation, and user-level delegation models. Advanced delegation features like monotonicity of delegation are described. The workshop will present a set of delegation mutant operators, proof-of-concept implementation, and preliminary results for testing delegation policies using mutation analysis.

1. MUTATION WORKSHOP @ ICST 2013
Testing Delegation Policy via Mutation Analysis
Phu H. Nguyen, Mike Papadakis, and Iram Rubab | March 18, 2013
SnT – Interdisciplinary Centre for Security, Reliability and Trust
University of Luxembourg
www.securityandtrust.lu

2. Outline
Background & Motivation
Access Control
Delegation
A motivative example
Formal definitions of Access Control & Delegation Policy model
AC & Delegation Policy model
Advanced Delegation Features
A set of delegation mutant operators
A proof-of-concept implementation & some preliminary results
Conclusion & future work
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 2/22

3. Background
Access Control (AC)
Aims at administering users access to resources by enforcing AC
policy.
An AC policy consists of a set of AC rules.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 3/22

4. Background
Access Control (AC)
Aims at administering users access to resources by enforcing AC
policy.
An AC policy consists of a set of AC rules.
Delegation
An important aspect of AC.
Plays a key role in the administration mechanism [BGTCCBB10].
“Normal” users themselves allowed to grant some authorizations by
delegation.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 3/22

5. A Motivative Example
Library Management System
Books can be borrowed and returned on working days. When the
library is closed, users can not borrow books. When a book is
already borrowed, a user can make a reservation for this book.
User accounts managed by an administrator (create, modify and
remove accounts for new users). A secretary who can order books,
add them in the LMS when they are delivered.
The director of the library has the same accesses than the secretary
and he can also consult the accounts of the employees. The
administrator and the secretary can consult all accounts of users. All
users can consult the list of books in the library.
Three types of users: public users who can borrow 5 books for 3
weeks, students who can borrow 10 books for 3 weeks and teachers
who can borrow 10 books for 2 months.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 4/22

6. An Example of AC policy
AC policy
Entities: roles, activities, views and contexts.
Policy: combinations of the entities with a status (permission/deny).
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 5/22

7. Some Delegation Situations
Simple delegation
The director delegates her/his permission of consulting personnel
accounts to a secretary during her/his absence.
A secretary delegates her/his role to a librarian.
Library
Management
System
add new books
create borrower
account
consult borrower
account
create borrow
account
<<delegatee>>
Librarian (Jane)
Access rights
Access rights
<<delegation>>
create borrow account
can access
can access
<<delegator>>
Secretary (Alice)
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 6/22

8. Some Delegation Situations (cont.)
Advanced delegation
A secretary transfers her/his role to a librarian.
A secretary is allowed to delegate his/her role to a librarian only and
to one librarian at a given time.
The director can delegate, on behalf of a secretary, the secretary’s
role to a librarian (e.g. during the secretary’s absence).
If a librarian empowered in role secretary by delegation is no longer
able to perform this task, then he/she can/cannot delegate, again,
this role to another librarian.
Users can always revoke their own delegations.
The director can revoke users from their delegated roles.
The role administrator is not delegable.
And so on.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 7/22

9. Formal Definitions
Definition (Access Control Policy Model)
Let U be a set of users, P be a set of permissions, and C be a set of
contexts. An access control policy AC is defined as a
user-permission-context assignment relation: AC ✓ U ⇥ P ⇥ C. A user u
is granted permission p in a given context c if and only if (u, p, c) 2 AC.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 8/22

10. Formal Definitions
Definition (Access Control Policy Model)
Let U be a set of users, P be a set of permissions, and C be a set of
contexts. An access control policy AC is defined as a
user-permission-context assignment relation: AC ✓ U ⇥ P ⇥ C. A user u
is granted permission p in a given context c if and only if (u, p, c) 2 AC.
Delegation
Built on top of an access control policy.
A delegation policy is composed of delegation rules.
Two levels of delegation rules: master-level vs. user-level.
Who has the right to delegate which permission to whom, and in which
context.
Who is delegating to whom which permission, and in which context.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 8/22

11. Delegation Policy Model
Definition (Master-Level Delegation)
Let U be a set of users, P be a set of permissions, and C be a set of
contexts. A master-level delegation policy MD is defined as a
user-user-permission-context assignment relation: MD ✓ U ⇥ U ⇥ P ⇥ C.
A delegation of a permission p from a user u1 to a user u2 in a given
context c can be performed if and only if (u1, u2, p, c) 2 MD.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 9/22

12. Delegation Policy Model
Definition (Master-Level Delegation)
Let U be a set of users, P be a set of permissions, and C be a set of
contexts. A master-level delegation policy MD is defined as a
user-user-permission-context assignment relation: MD ✓ U ⇥ U ⇥ P ⇥ C.
A delegation of a permission p from a user u1 to a user u2 in a given
context c can be performed if and only if (u1, u2, p, c) 2 MD.
Definition (User-Level Delegation)
Let U be a set of users, P be a set of permissions, and C be a set of
contexts. A user-level delegation policy UD is defined as a
user-user-permission-context assignment relation: UD ✓ U ⇥ U ⇥ P ⇥ C.
A user u2 can have a permission p by delegation from a user u1 in a
given context c if and only if (u1, u2, p, c) 2 UD.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 9/22

13. Context
Security context associated with AC and Delegation rules [CCB07]
The Temporal context that depends on the time at which a subject
is requesting for an access to the system.
The Spatial context that depends on the subject location, e.g. a
delegated permission is only active when the delegatee is at office.
The User-declared context that depends on the subject objective
(or purpose).
The Prerequisite context saying that a permission is delegated to a
subject, but only if some specific conditions (often stored in a
database) are satisfied, e.g. no more concurrent delegation of a
specific permission allowed exceeding a (predefined) threshold.
The Provisional context that depends on previous actions the
subject has performed in the system.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 10/22

14. Advanced Delegation Features
Monotonicity of Delegation
Whether or not the delegator can still use the permission while
delegating it.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 11/22

15. Advanced Delegation Features
Monotonicity of Delegation
Whether or not the delegator can still use the permission while
delegating it.
grantDelegation(u1, u2, p, c) :
pre (u1, p, c) 2 AC ^ (u2, p, c) /2 AC ^ (u1, u2, p, c) 2 MLD
body AC := AC [ {(u2, p, c)}; ULD := ULD [ {(u1, u2, p, c)} end
post (u1, p, c) 2 AC ^ (u2, p, c) 2 AC ^ (u1, u2, p, c) 2 ULD
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 11/22

16. Advanced Delegation Features
Monotonicity of Delegation
Whether or not the delegator can still use the permission while
delegating it.
grantDelegation(u1, u2, p, c) :
pre (u1, p, c) 2 AC ^ (u2, p, c) /2 AC ^ (u1, u2, p, c) 2 MLD
body AC := AC [ {(u2, p, c)}; ULD := ULD [ {(u1, u2, p, c)} end
post (u1, p, c) 2 AC ^ (u2, p, c) 2 AC ^ (u1, u2, p, c) 2 ULD
transferDelegation(u1, u2, p, c) :
pre (u1, p, c) 2 AC ^ (u2, p, c) /2 AC ^ (u1, u2, p, c) 2 MLD
body AC := AC {(u1, p, c)}; AC := AC [ {(u2, p, c)};
ULD := ULD [ {(u1, u2, p, c)} end
post (u1, p, c) /2 AC ^ (u2, p, c) 2 AC ^ (u1, u2, p, c) 2 ULD
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 11/22

17. Advanced Delegation Features (cont.)
Temporary Delegation
Its context is associated with some time constraint, only active while
the time constraint is satisfied.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 12/22

18. Advanced Delegation Features (cont.)
Temporary Delegation
Its context is associated with some time constraint, only active while
the time constraint is satisfied.
Temporal context: c := c&vacation_period(startDate, endDate)
vacation_period(startDate, endDate) :
startDate  endDate ^ afterDate(startDate) ^ beforeDate(endDate)
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 12/22

19. Advanced Delegation Features (cont.)
Temporary Delegation
Its context is associated with some time constraint, only active while
the time constraint is satisfied.
Temporal context: c := c&vacation_period(startDate, endDate)
vacation_period(startDate, endDate) :
startDate  endDate ^ afterDate(startDate) ^ beforeDate(endDate)
Some Others
Multiple Delegation
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 12/22

20. Advanced Delegation Features (cont.)
Temporary Delegation
Its context is associated with some time constraint, only active while
the time constraint is satisfied.
Temporal context: c := c&vacation_period(startDate, endDate)
vacation_period(startDate, endDate) :
startDate  endDate ^ afterDate(startDate) ^ beforeDate(endDate)
Some Others
Multiple Delegation
Multi-step Delegation
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 12/22

21. Advanced Delegation Features (cont.)
Temporary Delegation
Its context is associated with some time constraint, only active while
the time constraint is satisfied.
Temporal context: c := c&vacation_period(startDate, endDate)
vacation_period(startDate, endDate) :
startDate  endDate ^ afterDate(startDate) ^ beforeDate(endDate)
Some Others
Multiple Delegation
Multi-step Delegation
User-specific Delegation
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 12/22

22. Advanced Delegation Features (cont.)
Temporary Delegation
Its context is associated with some time constraint, only active while
the time constraint is satisfied.
Temporal context: c := c&vacation_period(startDate, endDate)
vacation_period(startDate, endDate) :
startDate  endDate ^ afterDate(startDate) ^ beforeDate(endDate)
Some Others
Multiple Delegation
Multi-step Delegation
User-specific Delegation
Revocation
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 12/22

23. Delegation Mutant Operators
Role-Based Access Control (RBAC)
introduces a set of role
decomposes the relation AC into user-role assignment UR ✓ U ⇥ R,
and role-permission-context assignment RPC ✓ R ⇥ P ⇥ C.
Thus, AC = UR RPC.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 13/22

24. Delegation Mutant Operators
Role-Based Access Control (RBAC)
introduces a set of role
decomposes the relation AC into user-role assignment UR ✓ U ⇥ R,
and role-permission-context assignment RPC ✓ R ⇥ P ⇥ C.
Thus, AC = UR RPC.
Basic Delegation Mutant Operators
The Permission Delegation Operator (PDM): to replace the
permission being delegated by another permission of the delegator.
PDM(u1, u2, p1a, c) :
pre (u1, u2, p1a, c) 2 ULD ^ (u1, r1) 2 UR ^ (u2, r2) 2
UR ^ (r1, p1a, c) 2 RPC ^ (r1, p1b, c) 2 RPC
body ULD := ULD {(u1, u2, p1a, c)} [ {(u1, u2, p1b, c)} ;
AC := AC [ {(u2, p1b, c)} end
post (u2, p1b, c) 2 AC ^ (u1, u2, p1b, c) 2 ULD
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 13/22

25. Basic Delegation Mutant Operators
(cont.)
The Role Delegation Operator (RDM)
The Role Delegation Operator (RDM) is used to simulate errors in
delegation of roles.
RDM(u1, u2, r1, c) :
pre (u1, r1) 2 UR ^ (u2, r2) 2 UR ^ (u3, r3) 2 UR ^ r1 6= r2 6=
r3 ^ (u1, u2, r1, c) 2 ULD
body ULD := ULD {(u1, u2, r1, c)} [ {(u3, u2, r3, c)} ;
UR := UR [ {(u2, r3)} end
post (u2, r3) 2 UR ^ (u3, u2, r3, c) 2 ULD
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 14/22

26. Advanced Delegation Mutant Operators
Monotonic Delegation Operators
The Transfer to Grant Delegation Operator (T2G) and the Grant to
Transfer Delegation Operator (G2T).
G2T(u1, u2, p, c&IsMonotonic) :
pre (u1, p, c) 2 AC ^ (u1, u2, p, c&IsMonotonic) 2 ULD
body ULD :=
ULD{(u1, u2, p, c&IsMonotonic)}[{(u1, u2, p, c&IsNonMonotonic)}
end
post (u1, p, c) /2 AC ^ (u1, u2, p, c&IsNonMonotonic) 2 ULD
T2G(u1, u2, p, c&IsNonMonotonic) :
pre (u1, p, c) /2 AC ^ (u1, u2, p, c&IsNonMonotonic) 2 ULD
body ULD :=
ULD {(u1, u2, p, c&IsMonotonic)} [ {(u1, u2, p, c&IsMonotonic)}
end
post (u1, p, c) 2 AC ^ (u1, u2, p, c&IsMonotonic) 2 ULD
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 15/22

27. Advanced Delegation Mutant Operators
(cont.)
Context-based Delegation Operators
e.g. Temporal Delegation Operator (TDM) to mutate the duration of
temporal delegation.
Role-Specific Delegation Operators
Role Delegation Off-Target 1 Operator (RDOT1).
Role Delegation Off-Target 2 Operator (RDOT2)
Permission-Specific Delegation Operators
Non-Delegable Permission Delegation Operator (NDPD) to mutate a
permission delegation by changing the delegated permission from
delegable to non-delegable.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 16/22

28. Advanced Delegation Mutant Operators
(cont.)
Multiple Delegation Operator
Multiple Delegation Operator (MultiD).
Multi-step Delegation Operator
Re-delegation Operator (ReD) add a new delegation rule into the
policy where the delegating permission/role must not be re-delegated
any more (stepCounter = 0).
Delegation Removal Operator
Tests should be able to detect that a delegation rule is missing.
Delegation Removal Operator (DR) that removes one of the
delegation rules.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 17/22

29. Model-Driven Adaptive Delegation
[NNK+
13]
Access Control
Service
Transformation
&
Adaptation
Delegation
Management Service
Resource
Proxy
Components
Role Proxy
Components
User Proxy
Components
Business
Components
Base model – Business
Logic mappings service
Native XML-DB
Server
Security
policy
model
Base
model
Business
Logic DB
Server
Authenticate
Component
Adaptive
Execution
Platform
Business
ComponentsBusiness Logic
Components
Resource
Proxy
Components
Role Proxy
Components
User Proxy
Components
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 18/22

30. 3-Layer Architecture reflecting Security
Policy
Personnel
Account
Service
Borrower
Account
Service
Book
Service
Personnel
Account
Resource
Borrower
Account
Resource
Book
Resource
Admin
Secretary
Librarian
Director
Student
Sam
Bob
Jane
Bill
Mary
consult
update
delete
create
consult
update
delete
create
deliver
fix
borrow
reserve
return
User layer Role layer Resource layer Business layer
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 19/22

31. Mutation Process
Transform
&
adapt
Resource
Proxy
Components
Role Proxy
Components
User Proxy
Components
Business
Components
Access Control
policy
Business
Logic model
Authenticate
Component
Adaptive
Execution
Platform
Business
Components
Business
Logic
Components
Resource
Proxy
Components
Role Proxy
Component
s
User Proxy
Components
Delegation
policy
Test
cases
Access Control
policy
Mutants
Mutants
Mutants
Mutate
Compose
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 20/22

32. Preliminary Results
Table: Some preliminary mutation analysis results
Test Case Killed Mutants Live Mutants
TC1 PDM (wrong permission) RDM (delegator fault)
TC2 PDM (wrong permission) RDM (delegator replaced)
TC3 T2G (wrong type) PDM, RDM (wrong delegator)
TC4 PDM (permission replaced) TDM (CE,CR)
TC5 TDM (CE,CR) PDM, RDM
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 21/22

33. Conclusion
Problem & Proposed Solution
Testing Delegation Policy with Advanced Delegation Features.
Delegation Mutant Operators and Mutation Analysis.
Discussion
Semantic delegation mutant operators are necessary to enable
mutation analysis for testing delegation.
“Meaningful” test cases should be generated for testing delegation.
Future work
A thorough empirical study using the proposed mutant operators.
Automatically generation of test cases for killing the proposed
mutants, based on [PM12, PM11].
The integration of Model-Based Testing.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 22/22

34. References
Meriam Ben-Ghorbel-Talbi, Frederic Cuppens, Nora Cuppens-Boulahia, and Adel Bouhoula.
A delegation model for extended rbac.
International Journal of Information Security, 9(3):209–236, June 2010.
Frédéric Cuppens and Nora Cuppens-Boulahia.
Modeling contextual security policies.
International Journal of Information Security, 7(4):285–305, November 2007.
Phu H. Nguyen, Gregory Nain, Jacques Klein, Tejeddine Mouelhi, and Yves Le Traon.
Model-Driven Adaptive Delegation.
In Proceedings of the Aspect-Oriented Software Development conference MODULARITY: aosd?13. ACM, 2013.
Mike Papadakis and Nicos Malevris.
Automatically performing weak mutation with the aid of symbolic execution, concolic testing and search-based testing.
Software Quality Journal, 19(4):691–723, 2011.
Mike Papadakis and Nicos Malevris.
Mutation based test case generation via a path selection strategy.
Information & Software Technology, 54(9):915–932, 2012.
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 22/22
Thanks to the Fonds National de la Recherche (FNR), Luxembourg
for supporting this work!

35. Questions?
The end
Thank you for your attention!
Outline Motivation Definitions Delegation Features Mutant Operators Preliminary Results Conclusion
Phu H. Nguyen, Mike Papadakis, and Iram Rubab – Testing Delegation Policy via Mutation Analysis March 18, 2013 22/22