15.6 Further Reading
The Decentralized Label Model [660] allows one to specify information flow policies on a per-entity basis. Formal models sometimes lead to reports of flows not present in the system; Eckmann [290] discusses these reports, as well as approaches to eliminating them. Guttmann draws lessons from the failure of an information flow analysis technique [385].
Foley [327] presented a model of confinement flow suitable for nonlattice structures, and models nontransitive systems of infoormation flow. Denning [240] describes how to turn a partially ordered set into a lattice, and presents requirements for information flow policies.
The cascade problem is identified in the Trusted Network Interpretation [258]. Numerous studies of this problem describe analyses and approaches [320, 441, 631]; the problem of correcting it with minimum cost is NP-complete [440].
Gendler-Fishman and Gudes [351] examine a compile-time flow control mechanism for object-oriented databases. McHugh and Good describe a flow analysis tool [606] for the language Gypsy. Greenwald et al. [379], Kocher [522], Sands [787], and Shore [826] discuss guards and other mechanisms for control of information flow.
A multithreaded environment adds to the complexity of constraints on information flow [842]. Some architectural characteristics can be used to enforce these constraints [462].