Security modelling using hierarchical state machines. - John P. Nestor (ACSAC, 1991)

Prerequisite Confidentiality. - John P. Nestor; E. S. Lee (CCS, 1994)