trusted computer system evaluation criteria ( orange book ) december .
A lattice model of secure information flow