Data Oriented Software Security Testing

With the fast developing of Internet and intelligent device, information security issue is becoming much more important every day. More and more researchers are attracted to software security testing study. Most of them put their works on software access control model based testing, which takes into account information mainly on multi-dimensions, like roles, permissions and contexts. But the key disadvantage of access control model based testing is its model are hard to be built in many circumstance, for example, to describe requirement "picture A is only allowed to be copied twice outside terminal B", researcher has to extend the original model with hierarchy status and priority sub models. To overcome this disadvantage, this paper present a framework of data oriented access control testing method, which focus mainly on data and its actions instead of role, permission and contexts. Though experiments, this paper also proves that the method is much more instructive than access control model in test cases automatic generating.