repeat (split; auto).
intros.
elim (fSSC SysSubjectSC root); auto.
contradiction.
contradiction.
contradiction.
Qed.
(*The main lemma deals with secuences of SFSstates.                  *)
(*In that lemma we'll use the function nth (defined in PolyList)     *)
(*which takes a natural (n), a list, and a default element with the  *)
(*type of the list, and returns the n(th) element of list if there   *)
(*are enough elements in it, or the default element if not.          *)
(*For this reason, we need to define a default SFSstate. In fact we  *)
(*won't use it in the proof, it's just a type requirement.           *)
Parameter defaultState : SFSstate.
(*The main Lemma for the model is the following one, wich says that  *)
(*for any given sequence of states such that the initial state is    *)
(*secure and for any two consecutives states, s and t, exists an     *)
(*operation (op) and a user (u) executing it, such that              *)
(*(TransFunc u s op t) holds, then every state in the secuence is    *)
(*secure.                                                            *)

(* Specifications: *)
Lemma BasicSecurityTheorem :
forall tr : list SFSstate,
GeneralSecureState (nth 0 tr defaultState) ->
(forall n : nat,
n < length tr ->
exists op : Operation,
(exists u : SUBJECT,
TransFunc u (nth n tr defaultState) op (nth (S n) tr defaultState))) ->
forall n : nat, n <= length tr -> GeneralSecureState (nth n tr defaultState).