Andrei Sabelfeld David Sands A Per Model of Secure Information Flow in Sequential Programs. 40-58 http://dx.doi.org/10.1007/3-540-49099-X_4 1999 conf/esop/1999 ESOP db/conf/esop/esop99.html#SabelfeldS99