Model-Based Tests for Access Control Policies1

author was on sabbatical leave at ENST Bretagne. Financial and organizational support is gratefully acknowledged. We present a model-based approach to testing ac-cess control requirements. By using combinatorial testing, we first automatically generate test cases from and without access control policies—i.e., the model— and assess the effectiveness of the test suites by means of mutation testing. We also compare them to purely random tests. For some of the investigated strategies, non-random tests kill considerably more mutants than the same number of random tests. Since we rely on policies only, no information on the application is re-quired at this stage. As a consequence, our methodol-ogy applies to arbitrary implementations of the policy decision points