Confidentiality properties and the B method. - Temitope Jos Onunkun (2012)