McLean, John ``Reasoning about Security Models,'' Proc. 1987 IEEE
Symposium on Research in Security and Privacy, IEEE Press, 1987. 
<P>