{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T12:19:16Z","timestamp":1784204356409,"version":"3.55.0"},"reference-count":97,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2018,12,4]],"date-time":"2018-12-04T00:00:00Z","timestamp":1543881600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Web"],"published-print":{"date-parts":[[2019,2,28]]},"abstract":"<jats:p>The diffusion of service-based and cloud-based systems has created a scenario where software is often made available as services, offered as commodities over corporate networks or the global net. This scenario supports the definition of business processes as composite services, which are implemented via either static or runtime composition of offerings provided by different suppliers. Fast and accurate evaluation of services\u2019 security properties becomes then a fundamental requirement and is nowadays part of the software development process. In this article, we show how the verification of security properties of composite services can be handled by test-based security certification and built to be effective and efficient in dynamic composition scenarios. Our approach builds on existing security certification schemes for monolithic services and extends them towards service compositions. It virtually certifies composite services, starting from certificates awarded to the component services. We describe three heuristic algorithms for generating runtime test-based evidence of the composite service holding the properties. These algorithms are compared with the corresponding exhaustive algorithm to evaluate their quality and performance. We also evaluate the proposed approach in a real-world industrial scenario, which considers ENGpay online payment system of Engineering Ingegneria Informatica S.p.A. The proposed industrial evaluation presents the utility and generality of the proposed approach by showing how certification results can be used as a basis to establish compliance to Payment Card Industry Data Security Standard.<\/jats:p>","DOI":"10.1145\/3267468","type":"journal-article","created":{"date-parts":[[2018,12,4]],"date-time":"2018-12-04T15:32:40Z","timestamp":1543937560000},"page":"1-43","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":15,"title":["Test-Based Security Certification of Composite Services"],"prefix":"10.1145","volume":"13","author":[{"given":"Marco","family":"Anisetti","sequence":"first","affiliation":[{"name":"Universit\u00e0 degli Studi di Milano, Via Celoria, Milano, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7426-4795","authenticated-orcid":false,"given":"Claudio","family":"Ardagna","sequence":"additional","affiliation":[{"name":"Universit\u00e0 degli Studi di Milano, Via Celoria, Milano, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ernesto","family":"Damiani","sequence":"additional","affiliation":[{"name":"Khalifa University, UAE, Universit\u00e0 degli Studi di Milano, Via Celoria, Milano, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gianluca","family":"Polegri","sequence":"additional","affiliation":[{"name":"Engineering Ingegneria Informatica S.p.A., Via S. Martino della Battaglia, Roma, RM, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2018,12,4]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/s12599-011-0155-7"},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of the 2004 IEEE International Conference on Services Computing (SCC\u201904)","author":"Aggarwal R.","unstructured":"R. Aggarwal , K. Verma , J. Miller , and W. Milnor . 2004. Constraint driven web service composition in METEOR-S . In Proceedings of the 2004 IEEE International Conference on Services Computing (SCC\u201904) . Shangai, China. R. Aggarwal, K. Verma, J. Miller, and W. Milnor. 2004. Constraint driven web service composition in METEOR-S. In Proceedings of the 2004 IEEE International Conference on Services Computing (SCC\u201904). Shangai, China."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2180861.2180864"},{"key":"e_1_2_1_4_1","unstructured":"A. Alves et al. 2007. Web Services Business Process Execution Language Version 2.0. OASIS. Retrieved from http:\/\/docs.oasis-open.org\/wsbpel\/2.0\/OS\/wsbpel-v2.0-OS.html.  A. Alves et al. 2007. Web Services Business Process Execution Language Version 2.0. OASIS. Retrieved from http:\/\/docs.oasis-open.org\/wsbpel\/2.0\/OS\/wsbpel-v2.0-OS.html."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2006.83"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCC.2011.27"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS.2013.70"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCC.2015.104"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2851613.2851628"},{"key":"e_1_2_1_10_1","unstructured":"M. Anisetti C. A. Ardagna E. Damiani and F. Gaudenzi. 2017. A semi-automatic and trustworthy scheme for continuous cloud service certification. IEEE Trans. Serv. Comput. (2017).  M. Anisetti C. A. Ardagna E. Damiani and F. Gaudenzi. 2017. A semi-automatic and trustworthy scheme for continuous cloud service certification. IEEE Trans. Serv. Comput. (2017)."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.09.012"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SOCA.2012.6449460"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2460383.2460384"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/11513988_27"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-10383-4_27"},{"key":"e_1_2_1_16_1","unstructured":"AVANTSSAR project. 2018. The AVANTSSAR Project IST-2001-39252. Retrieved from http:\/\/www.avantssar.eu\/.  AVANTSSAR project. 2018. The AVANTSSAR Project IST-2001-39252. Retrieved from http:\/\/www.avantssar.eu\/."},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the 8th International Conference on Ubiquitous Intelligence and Computing (UIC\u201911)","author":"Bai Y.","unstructured":"Y. Bai , Y. Zhang , Y. Zhou , and L. T. Yang . 2011. A non-functional property based service selection and service verification model . In Proceedings of the 8th International Conference on Ubiquitous Intelligence and Computing (UIC\u201911) . Y. Bai, Y. Zhang, Y. Zhou, and L. T. Yang. 2011. A non-functional property based service selection and service verification model. In Proceedings of the 8th International Conference on Ubiquitous Intelligence and Computing (UIC\u201911)."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2567948.2579222"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-05031-2_2"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS.2006.69"},{"key":"e_1_2_1_21_1","unstructured":"B. Bernhard. 2003. Web services container. Retrieved from http:\/\/www.google.com\/patents\/US20030033369 US Patent App. 10\/215 722.  B. Bernhard. 2003. Web services container. Retrieved from http:\/\/www.google.com\/patents\/US20030033369 US Patent App. 10\/215 722."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/CLOUD.2011.71"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/77648.77649"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS.2010.24"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2014.2381493"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1978.231496"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-02463-4_19"},{"key":"e_1_2_1_28_1","volume-title":"Non-Functional Requirements in Software Engineering","volume":"5","author":"Chung L.","unstructured":"L. Chung , B. A. Nixon , E. Yu , and J. Mylopoulos . 2000 . Non-Functional Requirements in Software Engineering , Vol. 5 . Springer, Heidelberg. L. Chung, B. A. Nixon, E. Yu, and J. Mylopoulos. 2000. Non-Functional Requirements in Software Engineering, Vol. 5. Springer, Heidelberg."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.5555\/1891823.1891830"},{"key":"e_1_2_1_30_1","volume-title":"Open Source Systems Security Certification","author":"Damiani E.","unstructured":"E. Damiani , C. A. Ardagna , and N. El Ioini . 2009. Open Source Systems Security Certification . Springer , New York, NY . E. Damiani, C. A. Ardagna, and N. El Ioini. 2009. Open Source Systems Security Certification. Springer, New York, NY."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1147\/sj.431.0136"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCC.2014.2300855"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2010.203"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2014.2361138"},{"key":"e_1_2_1_35_1","volume-title":"Proceedings of the 30th Euromicro Conference","author":"Dustdar S.","year":"2004","unstructured":"S. Dustdar and P. Fenkam . 2004. Formally designing web services for mobile team collaboration . In Proceedings of the 30th Euromicro Conference 2004 . Rennes, France. S. Dustdar and P. Fenkam. 2004. Formally designing web services for mobile team collaboration. In Proceedings of the 30th Euromicro Conference 2004. Rennes, France."},{"key":"e_1_2_1_36_1","doi-asserted-by":"crossref","unstructured":"M. Egea K. Mahbub G. Spanoudakis and M. R. Vieira. 2015. A certification framework for cloud security properties: The monitoring path. In Accountability and Security in the Cloud M. Felici and C. Fernandez-Gago (Eds.). Springer 63--77.  M. Egea K. Mahbub G. Spanoudakis and M. R. Vieira. 2015. A certification framework for cloud security properties: The monitoring path. In Accountability and Security in the Cloud M. Felici and C. Fernandez-Gago (Eds.). Springer 63--77.","DOI":"10.1007\/978-3-319-17199-9_3"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/b95547"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/11940197_3"},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the International Conference on Software Composition (SC\u201913)","author":"Fuchs A.","unstructured":"A. Fuchs and S. G\u00fcrgens . 2013. Preserving confidentiality in component compositions . In Proceedings of the International Conference on Software Composition (SC\u201913) . A. Fuchs and S. G\u00fcrgens. 2013. Preserving confidentiality in component compositions. In Proceedings of the International Conference on Software Composition (SC\u201913)."},{"key":"e_1_2_1_40_1","volume-title":"Proceedings of the IEEE Asia-Pacific Services Computing Conference (APSCC\u201911)","author":"Gao H.","unstructured":"H. Gao and Y. Li . 2011. Generating quantitative test cases for probabilistic timed web service composition . In Proceedings of the IEEE Asia-Pacific Services Computing Conference (APSCC\u201911) . H. Gao and Y. Li. 2011. Generating quantitative test cases for probabilistic timed web service composition. In Proceedings of the IEEE Asia-Pacific Services Computing Conference (APSCC\u201911)."},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.entcs.2010.08.005"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3064850"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2010.115"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS.2009.111"},{"key":"e_1_2_1_45_1","unstructured":"I. J. Hayes C. B. Jones and R. J. Colvin. 2013. Reasoning About Concurrent Programs: Refining Rely-guarantee Thinking. Computing Science Newcastle University.  I. J. Hayes C. B. Jones and R. J. Colvin. 2013. Reasoning About Concurrent Programs: Refining Rely-guarantee Thinking. Computing Science Newcastle University."},{"key":"e_1_2_1_46_1","volume-title":"Using the Common Criteria for IT Security Evaluation","author":"Herrmann D. S.","unstructured":"D. S. Herrmann . 2002. Using the Common Criteria for IT Security Evaluation . Auerbach Publications . D. S. Herrmann. 2002. Using the Common Criteria for IT Security Evaluation. Auerbach Publications."},{"key":"e_1_2_1_47_1","doi-asserted-by":"crossref","unstructured":"W. Hummer P. Leitner A. Michlmayr F. Rosenberg and S. Dustdar. 2011. VRESCo--Vienna runtime environment for service-oriented computing. In Service Engineering S. Dustdar and F. Li (Eds.). Springer 299--324.  W. Hummer P. Leitner A. Michlmayr F. Rosenberg and S. Dustdar. 2011. VRESCo--Vienna runtime environment for service-oriented computing. In Service Engineering S. Dustdar and F. Li (Eds.). Springer 299--324.","DOI":"10.1007\/978-3-7091-0415-6_11"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2008.2"},{"key":"e_1_2_1_49_1","volume-title":"Proceedings of the 15th Annual Conference on Computer Security Applications (ACSAC\u201999)","author":"Irvine C.","unstructured":"C. Irvine and T. Levin . 1999. Toward a taxonomy and costing method for security services . In Proceedings of the 15th Annual Conference on Computer Security Applications (ACSAC\u201999) . C. Irvine and T. Levin. 1999. Toward a taxonomy and costing method for security services. In Proceedings of the 15th Annual Conference on Computer Security Applications (ACSAC\u201999)."},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2008.10.001"},{"key":"e_1_2_1_51_1","volume-title":"Proceedings of the 8th International Conference on Innovations in Information Technology (IIT\u201912)","author":"Khan K. M.","unstructured":"K. M. Khan , A. Erradi , S. Alhazbi , and J. Han . 2012. Security oriented service composition: A framework . In Proceedings of the 8th International Conference on Innovations in Information Technology (IIT\u201912) . K. M. Khan, A. Erradi, S. Alhazbi, and J. Han. 2012. Security oriented service composition: A framework. In Proceedings of the 8th International Conference on Innovations in Information Technology (IIT\u201912)."},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/MITP.2010.128"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2008.04.044"},{"key":"e_1_2_1_54_1","first-page":"2","article-title":"Increased reliability in SOA environments through registry-based conformance testing of Web services","volume":"21","author":"Kourtesis D.","year":"2010","unstructured":"D. Kourtesis , E. Ramollari , D. Dranidis , and I. Paraskakis . 2010 . Increased reliability in SOA environments through registry-based conformance testing of Web services . Product. Plan. Contr. 21 , 2 (Jun. 2010), 130--144. D. Kourtesis, E. Ramollari, D. Dranidis, and I. Paraskakis. 2010. Increased reliability in SOA environments through registry-based conformance testing of Web services. Product. Plan. Contr. 21, 2 (Jun. 2010), 130--144.","journal-title":"Product. Plan. Contr."},{"key":"e_1_2_1_55_1","volume-title":"Proceedings of the International Symposium on Secure Virtual Infrastructures, Cloud and Trusted Computing 2016 (C8TC\u201915)","author":"Krotsiani M.","unstructured":"M. Krotsiani , G. Spanoudakis , and C. Kloukinas . 2015. Monitoring-based certification of cloud service security . In Proceedings of the International Symposium on Secure Virtual Infrastructures, Cloud and Trusted Computing 2016 (C8TC\u201915) . M. Krotsiani, G. Spanoudakis, and C. Kloukinas. 2015. Monitoring-based certification of cloud service security. In Proceedings of the International Symposium on Secure Virtual Infrastructures, Cloud and Trusted Computing 2016 (C8TC\u201915)."},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECOWS.2008.14"},{"key":"e_1_2_1_57_1","unstructured":"A. Landro. 2013. The Benefits of Cloud-based BPM. Retrieved from http:\/\/tinyurl.com\/hk9jy9g.  A. Landro. 2013. The Benefits of Cloud-based BPM. Retrieved from http:\/\/tinyurl.com\/hk9jy9g."},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/2831270"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2012.01.036"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/2576235"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2016.26"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCC.2016.2522411"},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1145\/1013367.1013379"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.14257\/ijgdc.2014.7.1.08"},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.5555\/2478565.2479065"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.5555\/794200.795152"},{"key":"e_1_2_1_67_1","volume-title":"Lecture Notes in Business Information Processing","volume":"10","author":"Mateescu R.","unstructured":"R. Mateescu and S. Rampacek . 2008. Formal modeling and discrete-time analysis of BPEL web services. In Advances in Enterprise Engineering I, J. L. G. Dietz (Ed.) . Lecture Notes in Business Information Processing , Vol. 10 . Springer Berlin, 179--193. R. Mateescu and S. Rampacek. 2008. Formal modeling and discrete-time analysis of BPEL web services. In Advances in Enterprise Engineering I, J. L. G. Dietz (Ed.). Lecture Notes in Business Information Processing, Vol. 10. Springer Berlin, 179--193."},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00778-003-0101-5"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2010.32"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/SERVICES.2013.15"},{"key":"e_1_2_1_71_1","unstructured":"A. Nadalin C. Kaler R. Monzillo and P. Hallam-Baker. 2006. Web Services Security: SOAP Message Security 1.1. OASIS. Retrieved from http:\/\/www.oasis-open.org\/committees\/download.php\/16790\/wss-v1.1-spec-os-SOAPMessageSecurity.pdf.  A. Nadalin C. Kaler R. Monzillo and P. Hallam-Baker. 2006. Web Services Security: SOAP Message Security 1.1. OASIS. Retrieved from http:\/\/www.oasis-open.org\/committees\/download.php\/16790\/wss-v1.1-spec-os-SOAPMessageSecurity.pdf."},{"key":"e_1_2_1_72_1","unstructured":"M. Najafi K. Sartipi and N. Archer. 2018. Formal Verification and Validation of Web Service Composition Certifier. Retrieved August 2018 from http:\/\/www.cas.mcmaster.ca\/ najafm\/journal4.pdf.  M. Najafi K. Sartipi and N. Archer. 2018. Formal Verification and Validation of Web Service Composition Certifier. Retrieved August 2018 from http:\/\/www.cas.mcmaster.ca\/ najafm\/journal4.pdf."},{"key":"e_1_2_1_73_1","first-page":"1","article-title":"Effective message-sequence generation for testing BPEL programs","volume":"6","author":"Ni Y.","year":"2013","unstructured":"Y. Ni , S.-S. Hou , L. Zhang , J. Zhu , Z. J. Li , Q. Lan , H. Mei , and J.-S. Sun . 2013 . Effective message-sequence generation for testing BPEL programs . IEEE Trans. Serv. Comput. 6 , 1 (Apr. 2013), 7--19. Y. Ni, S.-S. Hou, L. Zhang, J. Zhu, Z. J. Li, Q. Lan, H. Mei, and J.-S. Sun. 2013. Effective message-sequence generation for testing BPEL programs. IEEE Trans. Serv. Comput. 6, 1 (Apr. 2013), 7--19.","journal-title":"IEEE Trans. Serv. Comput."},{"key":"e_1_2_1_74_1","unstructured":"OMG 2011. Business Process Model and Notation (BPMN)--Version 2.0. OMG. Retrieved from http:\/\/www.omg.org\/spec\/BPMN\/2.0\/PDF\/.  OMG 2011. Business Process Model and Notation (BPMN)--Version 2.0. OMG. Retrieved from http:\/\/www.omg.org\/spec\/BPMN\/2.0\/PDF\/."},{"key":"e_1_2_1_75_1","volume-title":"BPM in the Cloud. OpenText. Retrieved","author":"OpenText","year":"2016","unstructured":"OpenText 2016. BPM in the Cloud. OpenText. Retrieved October 2016 from http:\/\/tinyurl.com\/jfx4pn5. OpenText 2016. BPM in the Cloud. OpenText. Retrieved October 2016 from http:\/\/tinyurl.com\/jfx4pn5."},{"key":"e_1_2_1_76_1","unstructured":"Oracle 2015. Oracle Process Cloud Service. Oracle. Retrieved from http:\/\/tinyurl.com\/jj3skoa.  Oracle 2015. Oracle Process Cloud Service. Oracle. Retrieved from http:\/\/tinyurl.com\/jj3skoa."},{"key":"e_1_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.datak.2009.02.016"},{"key":"e_1_2_1_78_1","volume-title":"Payment Card Industry (PCI) Data Security Standard--Requirements and Security Assessment Procedures--Version 3.1","author":"PCI Security Standards Council 2015.","unstructured":"PCI Security Standards Council 2015. Payment Card Industry (PCI) Data Security Standard--Requirements and Security Assessment Procedures--Version 3.1 . PCI Security Standards Council . Retrieved from http:\/\/csrc.nist.gov\/publications\/secpubs\/rainbow\/std001.txt. PCI Security Standards Council 2015. Payment Card Industry (PCI) Data Security Standard--Requirements and Security Assessment Procedures--Version 3.1. PCI Security Standards Council. Retrieved from http:\/\/csrc.nist.gov\/publications\/secpubs\/rainbow\/std001.txt."},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2011.98"},{"key":"e_1_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2003.1236471"},{"key":"e_1_2_1_81_1","volume-title":"Proceedings of the 5th IFIP Internation Conference on New Technologies, Mobility 8 Security (NTMS\u201912)","author":"Pino L.","unstructured":"L. Pino and G. Spanoudakis . 2012. Finding secure compositions of software services: Towards a pattern based approach . In Proceedings of the 5th IFIP Internation Conference on New Technologies, Mobility 8 Security (NTMS\u201912) . L. Pino and G. Spanoudakis. 2012. Finding secure compositions of software services: Towards a pattern based approach. In Proceedings of the 5th IFIP Internation Conference on New Technologies, Mobility 8 Security (NTMS\u201912)."},{"key":"e_1_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1977.32"},{"key":"e_1_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijinfomgt.2013.11.002"},{"key":"e_1_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-27269-1_7"},{"key":"e_1_2_1_85_1","volume-title":"Proceedings of the 23rd International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS\u201917)","author":"San\u00e1n D.","unstructured":"D. San\u00e1n , Y. Zhao , Z. Hou , F. Zhang , A. Tiu , and Y. Liu . 2017. CSimpl: A rely-guarantee-based framework for verifying concurrent programs . In Proceedings of the 23rd International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS\u201917) . D. San\u00e1n, Y. Zhao, Z. Hou, F. Zhang, A. Tiu, and Y. Liu. 2017. CSimpl: A rely-guarantee-based framework for verifying concurrent programs. In Proceedings of the 23rd International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS\u201917)."},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2012.3"},{"key":"e_1_2_1_87_1","volume-title":"Proceedings of the 9th IEEE International Conference on Cloud Computing (CLOUD\u201916)","author":"Stephanow P.","unstructured":"P. Stephanow , G. Srivastava , and J. Schutte . 2016. Test-based cloud service certification of opportunistic providers . In Proceedings of the 9th IEEE International Conference on Cloud Computing (CLOUD\u201916) . P. Stephanow, G. Srivastava, and J. Schutte. 2016. Test-based cloud service certification of opportunistic providers. In Proceedings of the 9th IEEE International Conference on Cloud Computing (CLOUD\u201916)."},{"key":"e_1_2_1_88_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.csi.2008.09.041"},{"key":"e_1_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1109\/TASE.2009.2018013"},{"key":"e_1_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2012.6297928"},{"key":"e_1_2_1_91_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISADS.2011.90"},{"key":"e_1_2_1_92_1","unstructured":"USA Department of Defence 1985. Department Of Defense Trusted Computer System Evaluation Criteria. USA Department of Defence. Retrieved from http:\/\/csrc.nist.gov\/publications\/secpubs\/rainbow\/std001.txt.  USA Department of Defence 1985. Department Of Defense Trusted Computer System Evaluation Criteria. USA Department of Defence. Retrieved from http:\/\/csrc.nist.gov\/publications\/secpubs\/rainbow\/std001.txt."},{"key":"e_1_2_1_93_1","volume-title":"International Software Testing Qualifications Board. Retrieved","author":"van Veenendaal E.","year":"2018","unstructured":"E. van Veenendaal . 2018. Standard Glossary of Terms Used in Software Testing Version 2.2 . International Software Testing Qualifications Board. Retrieved August 2018 from http:\/\/www.astqb.org\/educational-resources\/glossary.php. E. van Veenendaal. 2018. Standard Glossary of Terms Used in Software Testing Version 2.2. International Software Testing Qualifications Board. Retrieved August 2018 from http:\/\/www.astqb.org\/educational-resources\/glossary.php."},{"key":"e_1_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.1109\/KSE.2012.33"},{"key":"e_1_2_1_95_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38709-8_2"},{"key":"e_1_2_1_96_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2004.11"},{"key":"e_1_2_1_97_1","doi-asserted-by":"publisher","DOI":"10.1145\/2876513"}],"container-title":["ACM Transactions on the Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3267468","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3267468","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:57:44Z","timestamp":1750208264000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3267468"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,12,4]]},"references-count":97,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2019,2,28]]}},"alternative-id":["10.1145\/3267468"],"URL":"https:\/\/doi.org\/10.1145\/3267468","relation":{},"ISSN":["1559-1131","1559-114X"],"issn-type":[{"value":"1559-1131","type":"print"},{"value":"1559-114X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,12,4]]},"assertion":[{"value":"2016-12-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-08-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-12-04","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}