Bounded verification of Ruby on Rails data models
Proceedings of the 2011 International Symposium on Software Testing and Analysis
| Hi-index | 0.00 |
Protecting sensitive data stored behind online websites is a major challenge, but existing techniques are inadequate. Automated website builders typically offer very limited options for specifying custom access policies. Manually adding access policy checks to website code is tedious and error-prone, and it is currently not feasible to automatically verify that a website conforms to its required access policy. Furthermore, policies change over time, and it can be costly to modify an existing website to reflect the changes or to certify that the modified website still complies with the desired policy. This research presents a declarative modeling approach designed to address these issues, where the data model and the access policy are specified using Alloy, and the Weballoy tool automatically generates a dynamic website that guarantees the access policy by construction. (Copies available exclusively from MIT Libraries, Rm. 14-0551, Cambridge, MA 02139-4307. Ph. 617-253-5668; Fax 617-253-1690.)