Integrating access control into business processes is a non-trivial task. This paper presents an approach that combines the UML and B languages for the specification and validation of RBAC policies at the process level. It starts by modeling the access control rules using our extension of UML2 activity diagrams denominated as BAAC@UML (Business Activity Access Control with UML). The BAAC@UML models are then translated into a specification in the B language using our B4MSecure platform. Finally, the last step validates the RBAC policy by testing its formal specification using the B tools (Provers and Animators).

In this paper, we present a model-based testing tool resulting from a research project, named TASCCC. This tool is a complete tool chain dedicated to property-based testing in UML/OCL, that integrates various technologies inside a dedicated Eclipse plug-in. The test properties are expressed in a dedicated language based on property patterns. These properties are then used for two purposes. First, they can be employed to evaluate the relevance of a test suite according to specific coverage criteria. Second, it is possible to generate test scenarios that will illustrate or exercise the property. These test scenarios are then unfolded and animated on the Smartesting's Certify It model animator, that is used to filter out infeasible sequences. This tool has been used in industrial partnership, aiming at providing an assistance for Common Criteria evaluations, especially by providing test generation reports used to show the link between the test cases and the Common Criteria artefacts.

This paper describes the Tobias tool. Tobias is a combinatorial test generator which unfolds a test pattern provided by the test engineer, and performs various combinations and repetitions of test parameters and methods. Tobias is available on-line at tobias.liglab.fr . This website features recent improvements of the tool including a new input language, a traceability mechanism, and the definition of various ``selectors'' which achieve test suite reduction.

This paper evaluates the security specification techniques that employ Role Based Access Control (RBAC) variants. RBAC offers a special kind of access control mechanism based on the use of roles to grant permissions. Its variants include role hierarchy and separation of duty (SoD) constraints. The overall management of a RBAC supported system is made through its administrative, review and supporting system functions. In this paper, a summary of semi-formal and formal techniques employing RBAC is provided along with their benefits and limitations. Here, semi-formal techniques refer to UML+OCL while formal ones are based on Alloy. This paper may guide through the process of selecting an appropriate technique to specify security rules. This is done by analyzing the degree of coverage of RBAC including some extensions like SoD and role hierarchy. We also investigate the use of validation and verification tools in these techniques. We find that formal techniques are more amenable to automated analysis as compared to semi-formal ones. Semi-formal techniques are rich in specifying RBAC variants but have prototypic tools. Session based dynamic aspects of RBAC have been partly covered in both techniques.

Designing a security policy for an information system is a non-trivial task. In this paper, we consider the design of a security policy based on a variant of the RBAC model, close to SecureUML. This variant includes constraints for the separation of duty, as well as contextual constraints. Contextual constraints use information about the state of the functional model of the application to grant permissions to users. These constraints add flexibility to the security policy, but make its validation more difficult. In this paper, we first review two tools, USE and SecureMOVA, which can be used to analyse and validate a security policy. These tools focus on analyses of static aspects of the secured system. We then propose a new tool, based on the Z formal language, which uses animation of the specification to validate the static as well as dynamic aspects of the security policy, taking into account possible evolutions of the state of the functional model. We discuss how the security policy and the functional application are described to the tool, and what kind of queries and animations can be performed to analyse nominal and malicious behaviours of the system.

Test case prioritisation aims at finding an ordering which enhances a certain property of an ordered test suite. Traditional techniques rely on the availability of code or a specification of the program under test. In this paper, we propose to use string distances on the text of test cases for their comparison and elaborate a prioritisation algorithm. Such a prioritisation does not require code and can be useful for initial testing and in cases when code is difficult to instrument. We also briefly report on preliminary results of an experiment where the proposed prioritisation technique was compared with random permutations and four classical string distance metrics were evaluated.

This paper briefly describes the second version of the Tobias combinatorial test generator. This version improves the architecture of the tool to include filtering and test selection mechanisms. These mechanisms, associated with an efficient implementation, allow to generate and filter test suites of up to 1 million test cases.

Tobias is a combinatorial testing tool that was used succesfully on several case studies. Currently, the evolution of the tool goes through a significant redevelopment effort. A first step is the production of an executable specification of the Tobias Test Generator. The goal of this specification effort is to provide a synthetic and precise description of Tobias to the developers of the new tool. The specification is expressed in the Z language, supported by the Jaza animator. The executable character of the specification is exploited (1) to assess non-regression of the specification with respect to the existing tool, and (2) to explore new functionalities for the tool

Formal methods are nowadays the most rigorous way to produce software. However, the existing formal notations are not easy to use and understand for most people. Our approach proposes to circumvent this shortcoming by producing complementary graphical views on the formal developments. This paper addresses the graphical representation of formal B specifications using UML diagrams. A reverse-engineering approach is proposed to generate several class diagrams showing the static aspects of the B developments. These diagrams can help understand the specification for stakeholders who are not familiar with the B method, such as customers or certification authorities. A concept formation technique based on weighted link matrices is proposed to improve automation

One of the goals of the integration of formal and graphical methods is to reuse tool support associated with formal methods. This paper reports on a combination of the Jaza Z animator with the RoZ tool. RoZ produces a Z specification from an annotated UML class diagram. It also generates the specification of basic operations associated to the diagram. The paper recalls the principles of the RoZ tool, gives a typical animation session, and discusses how RoZ and class diagrams must be adapted to support animation

at U.C. Irvine hosted a workshop on the state of the art in automated software engineering. Its goal was to bring together ASE researchers for informal presentations of current work, with the hope of identifying emerging trends and challenges. The workshop started with an invited talk by P. Dourish. His talk pointed out the futility of requirements. In a context of ever evolving requirements, it is mandatory for software to be very adaptable. Automated software engineering may provide a solution to this flexibility demand, especially if deployed on the user’s site. Requirements was actually one the major topics discussed at the workshop with talks by R. Hall and S. Fickas who point out growing challenges of validating requirements and systems. Another major topic is to master the complexity of software engineering tasks and artifacts. This complexity is reflected in the diversity of models and notations used to describe software, tools and knowledge. It also requires the development of efficient tool support and tool infrastructure. These topics were addressed by the talks of J. Grundy, D. Redmiles, S. Henninger, F. Shipman and Y. Ledru. These position papers are available on line 1. The rest of this report gives their abstracts. Abstracts of the position papers

Nowadays, test cases may correspond to elaborate programs. It is therefore sensible to try to specify test cases in order to get a more abstract view of these. This paper explores the notion of test purpose as a way to specify a set of test cases. It shows how test purposes are exploited today by several tools that automate the generation of test cases. It presents the major relations that link test purposes, test cases and reference specification. It also explores the similarities and differences between the specification of test cases, and the specification of programs. This opens perspectives for the synthesis and the verification of test cases, and for other activities like test case retrieval.

Starting from a graphical data model (a subset of the OMT object model), a skeleton of formal specification can be generated and completed to express several constraints and provide a precise formal data description. Then standard operations to modify instances of this data model can be systematically specified. Since these operations may invalidate the constraints, it is interesting to identify their pre-conditions. In this paper, the Z-EVES theorem prover is used to calculate and try to simplify the pre-conditions of these operations. Then the developer may identify a set of conditions and use the prover to verify that they logically imply the pre-condition.