Protecting privacy using the decentralized label model. (2001)

by A C Myers, B Liskov
Venue:ACM Transactions on Software Engineering and Methodology,