Vincent Naessens Bart De Decker A Methodology for Designing Controlled Anonymous Applications. 111-122 2006 conf/sec/2006 SEC http://dx.doi.org/10.1007/0-387-33406-8_10 db/conf/sec/sec2006.html#NaessensD06