Jan Jürjens Markus Lehrhuber Guido Wimmel Model-Based Design and Analysis of Permission-Based Security. 224-233 2005 conf/iceccs/2005 ICECCS http://dx.doi.org/10.1109/ICECCS.2005.61 db/conf/iceccs/iceccs2005.html#JurjensLW05