Oliver Costich John McLean John P. McDermott Confidentiality in a Replicated Architecture Trusted Database System: A Formal Model. 1994 CSFW db/conf/csfw/csfw1994.html#CostichMM94 60-65