Giampaolo Bella Lawrence C. Paulson Accountability protocols: Formalized and verified. 138-161 2006 9 ACM Trans. Inf. Syst. Secur. 2 http://doi.acm.org/10.1145/1151414.1151416 db/journals/tissec/tissec9.html#BellaP06