Protecting privacy using the decentralized label model (2000)

by Andrew C Myers, Barbara Liskov
Venue:ACM Transactions on Software Engineering and Methodology