John McLean Proving Noninterference and Functional Correctness Using Traces. 1992 1 Journal of Computer Security 1 db/journals/jcs/jcs1.html#McLean92 37-58