Formal analysis of SAML 2.0 web browser single sign-on: breaking the SAML-based single sign-on for google apps. - Alessandro Armando; Roberto Carbone; Luca Compagna; Jorge Cuéllar; Llanos Tobarra (FMSE, 2008)

LTL model checking for security protocols. - Alessandro Armando; Roberto Carbone; Luca Compagna (J. Appl. Non Class. Logics, 2009)

Verification of S&D Solutions for Network Communications and Devices. - Carsten Rudolph; Luca Compagna; Roberto Carbone; Antonio Muñoz 001; Jürgen Repp (Security and Dependability for Ambient Intelligence, 2009)

Model-Checking Driven Security Testing of Web-Based Applications. - Alessandro Armando; Roberto Carbone; Luca Compagna; Keqin Li 002; Giancarlo Pellegrino (ICST Workshops, 2010)

Towards Formal Validation of Trust and Security in the Internet of Services. - Roberto Carbone; Marius Minea; Sebastian Mödersheim; Serena Elisa Ponta; Mathieu Turuani; Luca Viganò 001 (Future Internet Assembly, 2011)

Deploy, Adjust and Readjust: Supporting Dynamic Reconfiguration of Policy Enforcement. - Gabriela Gheorghe; Bruno Crispo; Roberto Carbone; Lieven Desmet; Wouter Joosen (Middleware, 2011)

From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure? - Alessandro Armando; Roberto Carbone; Luca Compagna; Jorge Cuéllar; Giancarlo Pellegrino; Alessandro Sorniotti (SEC, 2011)

Automated Analysis of Semantic-Aware Access Control Policies: A Logic-Based Approach. - Alessandro Armando; Roberto Carbone; Silvio Ranise (ICSC, 2011)

LTL model-checking for security protocols. - Roberto Carbone (AI Commun., 2011)

Formal Analysis of a Privacy-Preserving Billing Protocol. - Alessandro Armando; Roberto Carbone; Alessio Merlo (SmartGridSec, 2012)

The AVANTSSAR Platform for the Automated Validation of Trust and Security of Service-Oriented Architectures. - Alessandro Armando; Wihem Arsac; Tigran Avanesov; Michele Barletta; Alberto Calvi; Alessandro Cappai; Roberto Carbone; Yannick Chevalier; Luca Compagna; Jorge Cuéllar; Gabriel Erzse; Simone Frau; et al. (TACAS, 2012)

From Model-Checking to Automated Testing of Security Protocols: Bridging the Gap. - Alessandro Armando; Giancarlo Pellegrino; Roberto Carbone; Alessio Merlo; Davide Balzarotti (TAP@TOOLS, 2012)

Formal Modeling and Automatic Security Analysis of Two-Factor and Two-Channel Authentication Protocols. - Alessandro Armando; Roberto Carbone; Luca Zanetti (NSS, 2013)

An authentication flaw in browser-based Single Sign-On protocols: Impact and remediations. - Alessandro Armando; Roberto Carbone; Luca Compagna; Jorge Cuéllar; Giancarlo Pellegrino; Alessandro Sorniotti (Comput. Secur., 2013)

Attribute based access control for APIs in spring security. - Alessandro Armando; Roberto Carbone; Eyasu Getahun Chekole; Silvio Ranise (SACMAT, 2014)

Selective Release of Smart Metering Data in Multi-domain Smart Grids. - Alessandro Armando; Roberto Carbone; Eyasu Getahun Chekole; Claudio Petrazzuolo; Andrea Ranalli; Silvio Ranise (SmartGridSec, 2014)

SATMC: A SAT-Based Model Checker for Security-Critical Systems. - Alessandro Armando; Roberto Carbone; Luca Compagna (TACAS, 2014)

Android Permissions Unleashed. - Alessandro Armando; Roberto Carbone; Gabriele Costa 001; Alessio Merlo (CSF, 2015)

Security Threat Identification and Testing. - Roberto Carbone; Luca Compagna; Annibale Panichella; Serena Elisa Ponta (ICST, 2015)

Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications. - Avinash Sudhodanan; Alessandro Armando; Roberto Carbone; Luca Compagna (NDSS, 2016)

A delegated authorization solution for smart-city mobile applications. - Giada Sciarretta; Roberto Carbone; Silvio Ranise (RTSI, 2016)

Security of Mobile Single Sign-On: A Rational Reconstruction of Facebook Login Solution. - Giada Sciarretta; Alessandro Armando; Roberto Carbone; Silvio Ranise (SECRYPT, 2016)

SATMC: a SAT-based model checker for security protocols, business processes, and security APIs. - Alessandro Armando; Roberto Carbone; Luca Compagna (Int. J. Softw. Tools Technol. Transf., 2016)

Large-Scale Analysis & Detection of Authentication Cross-Site Request Forgeries. - Avinash Sudhodanan; Roberto Carbone; Luca Compagna; Nicolas Dolgin; Alessandro Armando; Umberto Morelli (EuroS&P, 2017)

PolEnA: Enforcing Fine-grained Permission Policies in Android. - Gabriele Costa 001; Federico Sinigaglia; Roberto Carbone (SAFECOMP Workshops, 2017)

Strong Authentication for e-Banking: A Survey on European Regulations and Implementations. - Federico Sinigaglia; Roberto Carbone; Gabriele Costa 001 (SECRYPT, 2017)

Anatomy of the Facebook solution for mobile single sign-on: Security assessment and improvements. - Giada Sciarretta; Roberto Carbone; Silvio Ranise; Alessandro Armando (Comput. Secur., 2017)

Design, Formal Specification and Analysis of Multi-Factor Authentication Solutions with a Single Sign-On Experience. - Giada Sciarretta; Roberto Carbone; Silvio Ranise; Luca Viganò 001 (POST, 2018)

Design and Security Assessment of Usable Multi-factor Authentication and Single Sign-On Solutions for Mobile Applications - A Workshop Experience Report. - Roberto Carbone; Silvio Ranise; Giada Sciarretta (Privacy and Identity Management, 2018)

MuFASA: A Tool for High-level Specification and Analysis of Multi-factor Authentication Protocols. - Federico Sinigaglia; Roberto Carbone; Gabriele Costa 001; Silvio Ranise (ETAA@ESORICS, 2019)

A Wizard-based Approach for Secure Code Generation of Single Sign-On and Access Delegation Solutions for Mobile Native Apps. - Amir Sharif; Roberto Carbone; Silvio Ranise; Giada Sciarretta (ICETE (2), 2019)

Security Considerations on 5G-Enabled Back-Situation Awareness for CCAM. - Marco Centenaro; Stefano Berlato; Roberto Carbone; Gianfranco Burzio; Giuseppe Faranda Cordella; Silvio Ranise; Roberto Riggio (5G World Forum, 2020)

Exploring Architectures for Cryptographic Access Control Enforcement in the Cloud for Fun and Optimization. - Stefano Berlato; Roberto Carbone; Adam J. Lee; Silvio Ranise (AsiaCCS, 2020)

The Good, the Bad and the (Not So) Ugly of Out-of-Band Authentication with eID Cards and Push Notifications: Design, Formal and Risk Analysis. - Marco Pernpruner; Roberto Carbone; Silvio Ranise; Giada Sciarretta (CODASPY, 2020)

Micro-Id-Gym: A Flexible Tool for Pentesting Identity Management Protocols in the Wild and in the Laboratory. - Andrea Bisegna; Roberto Carbone; Giulio Pellizzari; Silvio Ranise (ETAA@ESORICS, 2020)

Automated and Secure Integration of the OpenID Connect iGov Profile in Mobile Native Applications. - Amir Sharif; Roberto Carbone; Giada Sciarretta; Silvio Ranise (ETAA@ESORICS, 2020)

A survey on multi-factor authentication for online banking in the wild. - Federico Sinigaglia; Roberto Carbone; Gabriele Costa 001; Nicola Zannone (Comput. Secur., 2020)

Formal Analysis of Mobile Multi-Factor Authentication with Single Sign-On Login. - Giada Sciarretta; Roberto Carbone; Silvio Ranise; Luca Viganò 001 (ACM Trans. Priv. Secur., 2020)

Automated Risk Assessment and What-if Analysis of OpenID Connect and OAuth 2.0 Deployments. - Salimeh Dashti; Amir Sharif; Roberto Carbone; Silvio Ranise (DBSec, 2021)

Integrating a Pentesting Tool for IdM Protocols in a Continuous Delivery Pipeline. - Andrea Bisegna; Roberto Carbone; Silvio Ranise (ETAA, 2021)

Cryptographic Enforcement of Access Control Policies in the Cloud: Implementation and Experimental Assessment. - Stefano Berlato; Roberto Carbone; Silvio Ranise (SECRYPT, 2021)

Blockchain Based RAN Data Sharing. - Andreas Heider-Aviet; Danny Roswin Ollik; Stefano Berlato; Silvio Ranise; Roberto Carbone; Van Thanh Le; Nabil El Ioini; Claus Pahl; Hamid R. Barzegar (SMDS, 2021)

Safety-Related Cooperative, Connected, and Automated Mobility Services: Interplay Between Functional and Security Requirements. - Marco Centenaro; Stefano Berlato; Roberto Carbone; Gianfranco Burzio; Giuseppe Faranda Cordella; Roberto Riggio; Silvio Ranise (IEEE Veh. Technol. Mag., 2021)

SoK: A Survey on Technological Trends for (pre)Notified eIDAS Electronic Identity Schemes. - Amir Sharif; Matteo Ranzi; Roberto Carbone; Giada Sciarretta; Silvio Ranise (ARES, 2022)

End-to-End Protection of IoT Communications Through Cryptographic Enforcement of Access Control Policies. - Stefano Berlato; Umberto Morelli; Roberto Carbone; Silvio Ranise (DBSec, 2022)

Best current practices for OAuth/OIDC Native Apps: A study of their adoption in popular providers and top-ranked Android clients. - Amir Sharif; Roberto Carbone; Giada Sciarretta; Silvio Ranise (J. Inf. Secur. Appl., 2022)

Formal Modelling and Automated Trade-off Analysis of Enforcement Architectures for Cryptographic Access Control in the Cloud. - Stefano Berlato; Roberto Carbone; Adam J. Lee; Silvio Ranise (ACM Trans. Priv. Secur., 2022)

Cross-Domain Sharing of User Claims: A Design Proposal for OpenID Connect Attribute Authorities. - Amir Sharif; Francesco Antonio Marino; Giada Sciarretta; Giuseppe De Marco; Roberto Carbone; Silvio Ranise (ARES, 2023)

Control is Nothing Without Trust a First Look into Digital Identity Wallet Trends. - Zahra Ebadi Ansaroudi; Roberto Carbone; Giada Sciarretta; Silvio Ranise (DBSec, 2023)

Assurance, Consent and Access Control for Privacy-Aware OIDC Deployments. - Gianluca Sassetti; Amir Sharif; Giada Sciarretta; Roberto Carbone; Silvio Ranise (DBSec, 2023)

SecCo: Automated Services to Secure Containers in the DevOps Paradigm. - Luca Verderame; Luca Caviglione; Roberto Carbone; Alessio Merlo (RACS, 2023)

Work-in-Progress: A Sidecar Proxy for Usable and Performance-Adaptable End-to-End Protection of Communications in Cloud Native Applications. - Stefano Berlato; Matteo Rizzi; Matteo Franzil; Silvio Cretti; Pietro De Matteis; Roberto Carbone (EuroS&P Workshops, 2024)

CSRFing the SSO Waves: Security Testing of SSO-Based Account Linking Process. - Andrea Bisegna; Matteo Bitussi; Roberto Carbone; Luca Compagna; Silvio Ranise; Avinash Sudhodanan (EuroS&P, 2024)

A Risk-based Approach to Trustworthy AI Systems for Judicial Procedures. - Majid Mollaeefar; Eleonora Marchesini; Roberto Carbone; Silvio Ranise (Ital-IA, 2024)

Enhancing Security Testing for Identity Management Implementations: Introducing Micro-Id-Gym Language and Micro-Id-Gym Testing Tool. - Andrea Bisegna; Matteo Bitussi; Roberto Carbone; Silvio Ranise (IEEE Secur. Priv., 2024)

An Automated Multi-Layered Methodology to Assist the Secure and Risk-Aware Design of Multi-Factor Authentication Protocols. - Marco Pernpruner; Roberto Carbone; Giada Sciarretta; Silvio Ranise (IEEE Trans. Dependable Secur. Comput., 2024)

Relying on Trust to Balance Protection and Performance in Cryptographic Access Control. - Simone Brunello; Stefano Berlato; Roberto Carbone; Adam J. Lee; Silvio Ranise (SACMAT, 2025)

Enhancing National Digital Identity Systems: A Framework for Institutional and Technical Harm Prevention Inspired by Microsoft's Harms Modeling. - Giovanni Corti; Gianluca Sassetti; Amir Sharif; Roberto Carbone; Silvio Ranise (SECRYPT, 2025)

A methodology for the experimental performance evaluation of Access Control enforcement mechanisms based on business processes. - Stefano Berlato; Roberto Carbone; Silvio Ranise (J. Inf. Secur. Appl., 2025)

A secure and quality of service-aware solution for the end-to-end protection of IoT applications. - Stefano Berlato; Umberto Morelli; Roberto Carbone; Silvio Ranise (J. Netw. Comput. Appl., 2025)