Testing TLS using planning-based combinatorial methods and execution framework

Dimitris E. Simos, Josip Bozic, Bernhard Garn, Manuel Leithner, Feng Duan, Kristoffer Kleine, Yu Lei, Franz Wotawa

Publikation: Beitrag in einer FachzeitschriftArtikelForschungBegutachtung

Abstract

The TLS protocol is the standard for secure Internet communication between two parties. Unfortunately, there have been recently successful attacks like DROWN, ROBOT, or BREACH that indicate the necessity for thoroughly testing TLS implementations. In our research work, we focus on automated test case generation and execution for the TLS security protocol, where the aim is to combine planning with combinatorial methods for providing test cases that ideally also reveal previously unknown attacks. This is made feasible by creating appropriate input parameter models for different messages that can appear in a TLS message sequence. In this paper, we present the resulting test case generation and execution framework together with the corresponding test oracle. Furthermore, we discuss in detail empirical results obtained via testing different TLS implementations.

Originalspracheenglisch
Seiten (von - bis)1-27
Seitenumfang27
FachzeitschriftSoftware quality journal
Frühes Online-Datum1 Jun 2018
DOIs
PublikationsstatusElektronische Veröffentlichung vor Drucklegung. - 1 Jun 2018

Fingerprint

Network protocols
Planning
Testing
Internet
Communication

Schlagwörter

    ASJC Scopus subject areas

    • Software
    • !!Safety, Risk, Reliability and Quality

    Dies zitieren

    Testing TLS using planning-based combinatorial methods and execution framework. / Simos, Dimitris E.; Bozic, Josip; Garn, Bernhard; Leithner, Manuel; Duan, Feng; Kleine, Kristoffer; Lei, Yu; Wotawa, Franz.

    in: Software quality journal, 01.06.2018, S. 1-27.

    Publikation: Beitrag in einer FachzeitschriftArtikelForschungBegutachtung

    Simos, Dimitris E. ; Bozic, Josip ; Garn, Bernhard ; Leithner, Manuel ; Duan, Feng ; Kleine, Kristoffer ; Lei, Yu ; Wotawa, Franz. / Testing TLS using planning-based combinatorial methods and execution framework. in: Software quality journal. 2018 ; S. 1-27.
    @article{0a1dcc968c6a41178411579d9442a88d,
    title = "Testing TLS using planning-based combinatorial methods and execution framework",
    abstract = "The TLS protocol is the standard for secure Internet communication between two parties. Unfortunately, there have been recently successful attacks like DROWN, ROBOT, or BREACH that indicate the necessity for thoroughly testing TLS implementations. In our research work, we focus on automated test case generation and execution for the TLS security protocol, where the aim is to combine planning with combinatorial methods for providing test cases that ideally also reveal previously unknown attacks. This is made feasible by creating appropriate input parameter models for different messages that can appear in a TLS message sequence. In this paper, we present the resulting test case generation and execution framework together with the corresponding test oracle. Furthermore, we discuss in detail empirical results obtained via testing different TLS implementations.",
    keywords = "Combinatorial testing, Planning, Security protocols, Security testing, TLS",
    author = "Simos, {Dimitris E.} and Josip Bozic and Bernhard Garn and Manuel Leithner and Feng Duan and Kristoffer Kleine and Yu Lei and Franz Wotawa",
    year = "2018",
    month = "6",
    day = "1",
    doi = "10.1007/s11219-018-9412-z",
    language = "English",
    pages = "1--27",
    journal = "Software quality journal",
    issn = "0963-9314",
    publisher = "Springer New York",

    }

    TY - JOUR

    T1 - Testing TLS using planning-based combinatorial methods and execution framework

    AU - Simos, Dimitris E.

    AU - Bozic, Josip

    AU - Garn, Bernhard

    AU - Leithner, Manuel

    AU - Duan, Feng

    AU - Kleine, Kristoffer

    AU - Lei, Yu

    AU - Wotawa, Franz

    PY - 2018/6/1

    Y1 - 2018/6/1

    N2 - The TLS protocol is the standard for secure Internet communication between two parties. Unfortunately, there have been recently successful attacks like DROWN, ROBOT, or BREACH that indicate the necessity for thoroughly testing TLS implementations. In our research work, we focus on automated test case generation and execution for the TLS security protocol, where the aim is to combine planning with combinatorial methods for providing test cases that ideally also reveal previously unknown attacks. This is made feasible by creating appropriate input parameter models for different messages that can appear in a TLS message sequence. In this paper, we present the resulting test case generation and execution framework together with the corresponding test oracle. Furthermore, we discuss in detail empirical results obtained via testing different TLS implementations.

    AB - The TLS protocol is the standard for secure Internet communication between two parties. Unfortunately, there have been recently successful attacks like DROWN, ROBOT, or BREACH that indicate the necessity for thoroughly testing TLS implementations. In our research work, we focus on automated test case generation and execution for the TLS security protocol, where the aim is to combine planning with combinatorial methods for providing test cases that ideally also reveal previously unknown attacks. This is made feasible by creating appropriate input parameter models for different messages that can appear in a TLS message sequence. In this paper, we present the resulting test case generation and execution framework together with the corresponding test oracle. Furthermore, we discuss in detail empirical results obtained via testing different TLS implementations.

    KW - Combinatorial testing

    KW - Planning

    KW - Security protocols

    KW - Security testing

    KW - TLS

    UR - http://www.scopus.com/inward/record.url?scp=85047929159&partnerID=8YFLogxK

    U2 - 10.1007/s11219-018-9412-z

    DO - 10.1007/s11219-018-9412-z

    M3 - Article

    SP - 1

    EP - 27

    JO - Software quality journal

    JF - Software quality journal

    SN - 0963-9314

    ER -