一个组件安全自动化测试平台的设计与实现

研制自动化的组件安全测试工具将对基于组件的软件工程产生重大影响,并能有效保障组件软件的安全性和可靠性,是当今软件业界一个极具现实意义和挑战的课题.针对广泛使用的微软第三方COM组件,设计和实现了一个组件安全性测试的原型系统CSTS(Component Security Testing System).CSTS主要对组件从静态和动态两个级别进行安全性测试.在静态级别上,先分析出组件接口信息,然后对接口方法从参数个数、参数顺序、参数范围和参数类型等方面进行错误注入测试;在动态级别上,先执行测试驱动,然后对组件所依赖的内存、磁盘文件系统和注册表等环境进行错误注入,再通过强大的监测机制监视错误注入后组件执行情况来判断组件安全异常.所实现的原型系统CSTS具有自动化程度高、操作简单及测试效果较好等优点.

Design and Implementation of an Automatic Testing Platform for Component Security

The automatic testing tools of component security bring great effect on component-based software enginee-ring,and they can effectively ensure the security and reliability of component-based software.Aiming at the third-party Microsoft COM component used widespread,a prototype tool called CSTS(Component Security Testing System)was designed and implemented.It can employ two levels' testing for component security,namely static testing and dynamic testing.In the static testing level,CSTS firstly analyzes compon...