一个组件安全自动化测试平台的设计与实现  

Design and Implementation of an Automatic Testing Platform for Component Security

作　　者：陈锦富[1] 卢炎生[1] 谢晓东[1] 游亮[1] 温贤鑫[1] 

机构地区：[1]华中科技大学计算机科学与技术学院,武汉430074

出　　处：《计算机科学》2008年第12期229-233,261,共6页Computer Science

基　　金：国家预研项目(No.513150601)

摘　　要：研制自动化的组件安全测试工具将对基于组件的软件工程产生重大影响,并能有效保障组件软件的安全性和可靠性,是当今软件业界一个极具现实意义和挑战的课题。针对广泛使用的微软第三方COM组件,设计和实现了一个组件安全性测试的原型系统CSTS(Component Security Testing System)。CSTS主要对组件从静态和动态两个级别进行安全性测试。在静态级别上,先分析出组件接口信息,然后对接口方法从参数个数、参数顺序、参数范围和参数类型等方面进行错误注入测试;在动态级别上,先执行测试驱动,然后对组件所依赖的内存、磁盘文件系统和注册表等环境进行错误注入,再通过强大的监测机制监视错误注入后组件执行情况来判断组件安全异常。所实现的原型系统CSTS具有自动化程度高、操作简单及测试效果较好等优点。The automatic teSting tools of component security bring great effect on component-based software engineering, and they can effectively ensure the security and reliability of component-based software. Aiming at the third-party Microsoft COM component used widespread, a prototype tool called CSTS（Component Security Testing System）was designed and implemented. It can employ two levels＇ testing for component security, namely static testing and dynamic testing. In the static testing level, CSTS firstly analyzes component type information such component objects, methods and parameters etc. , and injects faults into interface method through parameter numbers, parameter sequence, parameter scope and parameter type for testing component. In the dynamic testing level, the tested component was firstly droved, and then the environment faults including memory fault, file system fault and registration fault etc. were injected into the tested component. Dynamic monitoring mechanism can monitor the component＇s runtime information after injecting the faults. CSTS can analyze the component exceptions by monitoring log file, and has high automation, good maneuverability and better testing ability.

关 键 词：测试工具 COM组件 安全测试 错误注入 动态监测 

分 类 号：TP311.52[自动化与计算机技术—计算机软件与理论] TU243[自动化与计算机技术—计算机科学与技术]