John McLean Reasoning About Security Models. 123-133 1987 IEEE Symposium on Security and Privacy db/conf/sp/sp1987.html#McLean87