James Heather Jonathan Y. Clark 99-114 2004 conf/ifip1-7/2004 Formal Aspects in Security and Trust http://dx.doi.org/10.1007/0-387-24098-5_8 db/conf/ifip1-7/fast2004.html#HeatherC04