An Access Control Model Based Testing Approach for Smart Card Applications: Results of the POS ´E Project

Abstract: This paper is about generating security tests from the Common Criteria expression of a security policy, in addition to func-tional tests previously generated by a model-based testing approach. The method that we present re-uses the functional model and the con-cretization layer developed for the functional testing, and relies on an additional security policy model. We discuss how to produce the security policy model from a Common Criteria security target. We propose to compute the tests by using some test purposes as guides for the tests to be extracted from the models. We see a test purpose as the combination of a security property and a test need issued from the know-how of a security engineer. We propose a language based on regular expressions for the expression of such test purposes. We illustrate our approach by means of the IAS1 case study, a smart card application dedicated to the operations of Identification, Authentica-tion and electronic Signature