A Scenario Driven Approach for Security Policy Testing Based on Model Checking

Security policy system is critical to the security sensitive implementation systems. To increase confidence in the correctness of the security policies, policy developers can conduct policy testing to ensure security policies are correctly implemented in these systems. In this paper we present a novel framework for security policy testing. The framework takes the privilege scenario as the source of test cases for security policies. The privilege scenario generation algorithm is presented, on the base of which privilege scenarios can be automatically generated by dint of model checking. Then we describe the method for privilege scenarios transforming into test cases. At last test coverage criteria are given. The framework covers all elements for the scenario based testing and provides a comprehensive solution for the security policy testing.