Toby C. Murray Gavin Lowe Analysing the Information Flow Properties of Object-Capability Patterns. 81-95 2009 Formal Aspects in Security and Trust http://dx.doi.org/10.1007/978-3-642-12459-4_7 conf/ifip1-7/2009 db/conf/ifip1-7/fast2009.html#MurrayL09