Thomas P. Jensen Daniel Le Métayer Tommy Thorn Verification of Control Flow based Security Properties. 89-103 1999 IEEE Symposium on Security and Privacy http://computer.org/conferen/proceed/s%26p/0176/01760089abs.htm db/conf/sp/sp1999.html#JensenMT99