Bob Blakley Darrell M. Kienzle Some weaknesses of the TCB model. 3-5 1997 conf/sp/1997 IEEE Symposium on Security and Privacy http://doi.ieeecomputersociety.org/10.1109/SECPRI.1997.601305 db/conf/sp/sp1997.html#BlakleyK97