Marina Blanton Mikhail J. Atallah Provable bounds for portable and flexible privacy-preserving access. 95-101 2005 conf/sacmat/2005 SACMAT http://doi.acm.org/10.1145/1063979.1063997 db/conf/sacmat/sacmat2005.html#BlantonA05