Volkmar Lotz Volker Kessler Georg Walter A Formal Security Model for Microprocessor Hardware. 718-737 1999 conf/fm/1999-1 World Congress on Formal Methods http://link.springer.de/link/service/series/0558/bibs/1708/17080718.htm db/conf/fm/fm1999-1.html#LotzKW99