Carl E. Landwehr Formal Models for Computer Security. 247-278 1981 13 ACM Comput. Surv. 3 db/journals/csur/csur13.html#Landwehr81