Fine-Grained Modeling of Web Services for Test-Based Security Certification

We present a solution for test-based security certification of services that models the service under certification using a Symbolic Transition System (STS). The STS-based model is readily derivable from the Web Service Description Language (WSDL) and Web Service Conversation Language (WSCL) of the service, and can be enriched with details about test-based conditions on inputs and outputs, implementation details, and security specifications. In addition, we show how such fine-grained modeling can be included in a test-based security certification process. Finally, we discuss how this process can be integrated within the Web service life-cycle and used for matching users' preferences and comparing certificates of different services.