| Summary |
|
Access control is one of the most
fundamental and widely used privacy and security mechanisms at both
application and network levels. Given the high importance and delicacy
of security policies, ensuring the correctness of security policies is
important, and yet difficult. A tiny error in security policies could
lead to irreparable, if not tragic, consequences. Therefore,
identifying discrepancies between policy specifications and their
intended function is a crucial task. To achieve this goal, security
policies must undergo systematic, rigorous testing and verification to
ensure that they truly represent the intention of their policy authors.
This project develops novel techniques and tools for testing and
verification of security policies including XACML and firewall policies
as well as security models.
We have a subproject on Specification,
Testing, and Verification of Risk Adaptable Access Control (RAdAC).
|
| Project
Overview Paper |
- JeeHyun Hwang, Evan Martin, Tao Xie, and Vincent C.
Hu. Policy-Based Testing. Encyclopedia
of Software Engineering, 1:1, 673 - 683, 01 November 2010.
[PDF][BibTex]
|
| Publications |
- Jeehyun Hwang, and Tao Xie, Donia Elkateb, Tejeddine
Mouelhi, and Yves Le Traon. Selection
of Regression System Tests for Security Policy Evolution.
In Proceedings of the 27th IEEE/ACM International Conference on
Automated Software Engineering (ASE 2012),
Short Paper, Essen, Germany,
September 2012. [PDF][BibTeX]
- Donia Elkateb, Tejeddine Mouelhi, Yves Le Traon,
Jeehyun Hwang, and Tao Xie.
Refactoring Access Control Policies for Performance Improvement.
In Proceedings of the 3rd ACM/SPEC International Conference on
Performance Engineering (ICPE
2012), Boston, MA, April 2012.
[PDF][BibTeX]
- Jeehyun Hwang, Tao Xie, Fei Chen, and Alex X. Liu. Systematic Structural Testing of
Firewall Policies. In IEEE Transactions on
Network and Service Management (TNSM). Volume 9, Issue 1, Pages 1- 11,
2012 [PDF][BibTeX]
- Fei Chen, Alex X. Liu, JeeHyun Hwang, and Tao Xie.
First Step Towards Automatic Correction of Firewall Policy Faults. ACM
Transactions on Autonomous and Adaptive Systems (TAAS). Vol. 7, No. 2,
2012. [PDF][BibTeX]
- Alex X. Liu, Fei Chen, JeeHyun Hwang, and Tao Xie. Designing Fast and Scalable XACML
Policy Evaluation Engines. IEEE Transactions on Computers (TC).
Volume 60, Issue 12, Pages 1802-1817, 2011. [PDF][BibTeX]
- Vincent Hu, Richard Kuhn, Tao Xie, and JeeHyun Hwang.
Model Checking
for Verification of Mandatory Access Control Models and Properties.
In International Journal of Software Engineering and Knowledge
Engineering. [PDF][BibTeX]
- Fei Chen, Alex X. Liu, JeeHyun Hwang, and Tao Xie. First Step Towards Automatic
Correction of Firewall Policy Faults.
In Proceedings of the 24th USENIX Large Installation System
Administration Conference (LISA 2010),
San Jose, CA, November 2010.
[PDF][BibTeX]
Best Student Paper
Award
- JeeHyun Hwang, Evan Martin, Tao Xie, and Vincent C.
Hu. Policy-Based Testing. Encyclopedia
of Software Engineering, 1:1, 673 - 683, 01 November 2010.
[PDF][BibTex]
- JeeHyun Hwang, Tao Xie, Vincent Hu, and Mine Altunay.
ACPT: A Tool
for Modeling and Verifying Access Control Policies.
In Proceedings of the IEEE International Symposium on Policies for
Distributed Systems and Networks (POLICY 2010),
System Demo, George
Mason University, USA, July 2010. [PDF][BibTeX]
- JeeHyun Hwang, Tao Xie, Vincent Hu, and Mine Altunay.
Mining Likely
Properties of Access Control Policies via Association Rule Mining.
In Proceedings of the 24th Annual IFIP WG 11.3 Working Conference on
Data and Applications Security (DBSec 2010),
Rome, Italy, June 2010.
[PDF][BibTeX]
- JeeHyun Hwang, Tao Xie, Fei Chen, and Alex X. Liu. Fault Localization for Firewall
Policies. In Proceedings of the 28th IEEE International
Symposium on
Reliable Distributed Systems (SRDS 2009),
Short Paper, Niagara Falls,
New York, September 2009. [PDF][BibTeX]
- JeeHyun Hwang, Tao Xie, and Vincent C. Hu. Detection of
Multiple-Duty-Related Security Leakage in Access Control Policies.
In Proceedings of the 3rd IEEE International Conference on
Secure Software Integration and Reliability Improvement (SSIRI 2009),
Shanghai, China, July 2009. [PDF][BibTeX]
- Ting Yu, Dhivya Sivasubramanian, and Tao Xie. Security Policy Testing via
Automated Program Code Generation
(Extended Abstract). In Proceedings of Cyber Security and Information
Intelligence Research Workshop (CSIIRW
2009), Oak Ridge, TN, April
2009. [PDF][BibTeX]
- Vincent Hu, Richard Kuhn, and Tao Xie. Property Verification for Generic
Access Control Models. In Proceedings of IEEE/IFIP
International Symposium on Trust, Security and Privacy for Pervasive
Applications (TSP
2008), Shanghai, China, December 2008. [PDF][BibTeX]
- Evan Martin, JeeHyun Hwang, Tao Xie, and Vincent Hu. Assessing Quality of Policy
Properties in Verification of Access Control Policies. In
Proceedings of 24th Annual Computer Security Applications Conference
(ACSAC 2008),
Anaheim, California, December 2008. [PDF][BibTeX]
- JeeHyun Hwang, Tao Xie, Fei Chen, and Alex X. Liu. Systematic Structural Testing of
Firewall Policies. In Proceedings of the 27th IEEE
International Symposium on Reliable Distributed Systems (SRDS
2008),
Napoli, Italy, October 2008. [PDF][BibTeX]
Alex X. Liu, Fei Chen, JeeHyun Hwang, and Tao Xie. XEngine: A Fast and Scalable
XACML Policy Evaluation Engine. In Proceedings of the
International Conference on Measurement and Modeling of Computer
Systems (SIGMETRICS
2008), Annapolis, Maryland, pp. 265-276, June 2008.
[PDF][BibTeX]
- Nuo Li, JeeHyun Hwang, and Tao Xie. Multiple-Implementation Testing
for XACML Implementations. In Proceedings of the Workshop
on Testing, Analysis and Verification of Web Software (TAV-WEB 2008),
Seattle, WA, pp. 27-33, July 2008. [PDF][BibTeX]
- Vincent Hu, Rick Kuhn, and Tao Xie. Property Verification for Access
Control Models via Model Checking. North Carolina State
University Department of Computer Science Technical report TR-2008-1,
January 4, 2008. [PDF][BibTex]
- Vincent C. Hu, Evan Martin, JeeHyun Hwang, and Tao
Xie. Conformance
Checking of Access Control Policies Specified in XACML. In
Proceedings of the 1st IEEE International Workshop on Security in
Software Engineering (IWSSE
2007), Beijing, China, pp. 275-280, July
2007. [PDF][Slides][BibTeX]
- Evan Martin and Tao Xie. Automated Test Generation for
Access Control Policies via Change-Impact Analysis. In
Proceedings of the 3rd International Workshop on Software Engineering
for Secure Systems (SESS
2007), Minneapolis, MN, pp. 5-11, May 2007.
[PDF][BibTeX]
- Evan Martin. Testing
and Analysis of Access Control Policies. In Companion
Proceedings of the 29th International Conference on Software
Engineering (ICSE
2007), Doctoral Symposium, Minneapolis, MN, pp.
75-76, May 2007. [PDF]
- Evan Martin and Tao Xie. A Fault Model and Mutation
Testing
of Access Control Policies. In Proceedings of the 16th
International Conference on World Wide Web (WWW 2007), Security,
Privacy, Reliability, and Ethics Track, Banff, Alberta,
Canada, pp.
667-676, May 2007. [PDF][Slides][BibTeX]
- Evan Martin, Tao Xie, and Ting Yu. Defining and Measuring Policy
Coverage in Testing Access Control Policies. In
Proceedings of the 8th International Conference on Information and
Communications Security (ICICS 2006),
Raleigh, NC, pp. 139-158,
December 2006. [PDF][BibTeX]
- Evan Martin and Tao Xie. Automated Test Generation for
Access Control Policies. In Supplemental Proceedings of
the 17th IEEE International Conference on Software Reliability
Engineering (ISSRE
2006), Fast
Abstracts, Raleigh, NC, November 2006. [PDF][BibTeX]
- Evan Martin. Automated
Test Generation for Access Control Policies. In
Proceedings of the 20th Annual ACM SIGPLAN International Conference on
Object-Oriented Programming, Systems, Languages, and Applications
(Companion) (OOPSLA
2006), ACM
SIGPLAN Student Research Competition, Portland, Oregon, USA,
pp. 752-753, October 2006. [PDF]
- Evan Martin and Tao Xie. Inferring Access-Control Policy
Properties via Machine Learning. In Proceedings of the 7th
IEEE Workshop on Policies for Distributed Systems and Networks (POLICY 2006),
London, Ontario Canada, pp. 235-238, June 2006. [PDF][BibTeX]
|
| Presentation |
- Tao Xie.Systematic Testing and Verification of
Security Policies. Invited talk. National Institute of Standards and
Technology (NIST) Computer
Security Division Seminar, August 2008. [Slides]
- Tao Xie. Conformance Checking of Access Control
Policies Specified in XACML. Workshop presentation, the 1st IEEE
International Workshop on Security in Software Engineering (IWSSE
2007), Beijing, China, July 2007.
- Evan Martin. Automated Test Generation for Access
Control Policies via Change-Impact Analysis. Workshop presentation, the
3rd International Workshop on Software Engineering for Secure Systems (SESS
2007), Minneapolis, MN, May 2007.
- Evan Martin. Testing and Analysis of Access Control
Policies. Conference doctoral Symposium presentation. the 29th
International Conference on Software Engineering (ICSE 2007),
Minneapolis, MN, May 2007.
- Tao Xie. A Fault Model and Mutation Testing of Access
Control Policies. Conference presentation, the 16th International
Conference on World Wide Web (WWW 2007), Security, Privacy,
Reliability, and Ethics Track, Banff, Alberta, Canada, May
2007.
- Evan Martin. Defining and Measuring Policy Coverage
in Testing Access Control Policies. Conference presentation, the 8th
International Conference on Information and Communications Security (ICICS 2006),
Raleigh, NC, December 2006.
- Evan Martin. Automated Test Generation for Access
Control Policies. Conference fast abstract presentation, the 17th IEEE
International Conference on Software Reliability Engineering (ISSRE 2006),
Fast
Abstracts, Raleigh, NC, November 2006.
- Evan Martin. Automated test generation for access
control policies. Conference ACM SIGPLAN SRC presentation, the 20th
Annual ACM SIGPLAN International Conference on Object-Oriented
Programming, Systems, Languages, and Applications (Companion) (OOPSLA 2006), ACM
SIGPLAN Student Research Competition, Portland, Oregon, USA,
October 2006.
- Evan Martin. Inferring Access-Control Policy
Properties via Machine Learning. Workshop presentation, the 7th IEEE
Workshop on Policies for Distributed Systems and Networks (POLICY 2006),
London, Ontario Canada, June 2006.
- Tao Xie. Towards Systematic Testing of Access Control
Policies. Invited talk, Foundation
of Software Engineering Group, Microsoft Research, April 2006.
|
|
