Constance L. Heitmeyer Applying Practical Formal Methods to the Specification and Analysis of Security Properties. 84-89 2001 conf/mmmacns/2001 MMM-ACNS http://link.springer.de/link/service/series/0558/bibs/2052/20520084.htm db/conf/mmmacns/mmmacns2001.html#Heitmeyer01