Andrew C. Myers    Barbara Liskov

IEEE Security & Privacy, 1998

1  Introduction
2  Decentralized labels
2.1  Model
   2.2  Example
   2.3  Limitations of the model
3  Extending and interpreting labels
   3.1  Generalizing labels
   3.2  Principal hierarchy
   3.3  Interpreting labels
   3.4  Flow set constraints
   3.5  Label functions
4  Checking relabeling statically
   4.1  Annotations
   4.2  Static correctness condition
   4.3  A sound and complete relabeling rule
   4.4  Static checking
5  Related work
6  Conclusions
7  Acknowledgments

This paper is also available in other formats: PostScript, PDF.