基于安全规则变异的Web Services安全性测试方法  

A Testing Approach for Web Services Security Based on Security Rules Mutation

作　　者：陈锦富[1,3] 李青[1] 毛澄映[2,3] 詹永照[1] 黄如兵[4] 陈加梅[1] 

机构地区：[1]江苏大学计算机科学与通信工程学院,江苏镇江212013 [2]江西财经大学软件与通信工程学院,南昌330013 [3]斯文本科技大学信息和通信技术学院,澳大利亚墨尔本VIC3122 [4]华中科技大学计算机科学与技术学院,武汉430074

出　　处：《计算机学报》2013年第10期1967-1981,共15页Chinese Journal of Computers

基　　金：国家自然科学基金(61202110,61063013);教育部博士点专项基金(20103227120005);江苏省自然科学基金(BK2012284)资助~~

摘　　要：针对已有变异测试研究中仅考虑对SOAP(Simple Object Access Protocol)消息输入参数的变异处理,而缺乏对SOAP消息安全规则变异的研究,文中从消息机密性、完整性及身份认证等方面对安全规则进行归类,提出了一种基于安全规则变异的Web Services安全性测试方法.首先给出一种安全规则变异测试框架,研究变异点判定规则库,设计出相应的变异操作算子、漏洞判定准则以及基于优先级与权重策略的变异算子选择方法.然后提出一种基于安全规则变异的测试用例生成算法,依照算法生成违背安全规则的SOAP消息,从而揭露Web Services的安全类故障.最后实现了一个Web Services安全性测试工具WSSTT(Web Services Security Testing Tool),在工具的基础上进行实验和对比分析,验证了文中提出的基于安全规则变异的Web Services安全测试方法的可行性和有效性.At present, the researches on Web Services mutation testing mainly focus on the input parameters mutation of SOAP （Simple Object Access Protocol） message, thereby lack of consid- ering on the security rules mutation. To resolve this drawback, this paper classifies the security rules from the perspective of confidentiality, integrity and authentication of message, and proposes a Web Services security testing approach based on the security rules mutation. Firstly, a mutation testing framework of security rules is presented. The vulnerability determination rule set is provided and some mutation operators of security rules are designed according to security types of SOAP message. Based on the priority and weight strategy, this paper also gives the strategies which are used to select mutation operators. Then the security test cases generation algorithm is presented based on security rules mutation, and the efficiency of the algorithm is also analyzed.Finally, a Web Services security testing tool named WSSTT （Web Services Security Testing Tool） is developed to verify the feasibility and effectiveness of the security testing approach proposed in this paper.

关 键 词：WEB SERVICES SOAP消息 安全规则变异 变异测试 变异算子 原型工具 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]