Dorothy E. Denning Lessons Learned from Modeling a Secure Multilevel Relational Database System. 35-43 1987 DBSec db/conf/dbsec/dbsec87.html#Denning87