Currently, I'm developing the concept of attribute-based access control (ABAC) model for a digital chain of custody system in law enforcement. How to perform testing of attribute-based access control model that has been developed is. Some paper write testing methods through a formal methods approach.
Are there other ways to do the testing other than using the formal methods approach.
How about a probabilistic proof?
https://en.wikipedia.org/wiki/Probabilistically_checkable_proof
There is a *tiny* bit of this in the secondary questions some login systems gather. Also see multi-factor systems.
As an extreme case see - http://dl.acm.org/citation.cfm?id=222268 which should be here in ResearchGate as well.
A paper from NIST (second link below) called "Pseudo-‐exhaustive Testing of Attribute Based Access Control Rules" by Kuhn et. al. has one approach for testing that tries to exhaustively test possibilities rather than direct formal methods. The survey paper at the first link below (paywall), "Specification and Analysis of Attribute-Based Access Control Policies: An Overview" by Dianxiang Xu and Yunpeng Zhang talks about different methods for validating ABAC policies. I don't know what you are implementing the model in, but when I looked at ABAC I used XACML.
http://ieeexplore.ieee.org/xpls/icp.jsp?arnumber=6901639&tag=1
http://csrc.nist.gov/groups/SNS/acts/documents/abac-pseudo-ex-iwct.pdf
Dear Prof Phillip and Jeff, thanks for the information that has been given. really helped me to understand more about this issue.
- Badges
- Science topic
- Similar topics
- Chemistry
- Theoretical Chemistry
- Computational Chemistry
- Molecular Dynamics