Composing and decomposing systems under security properties - Roscoe, A; Wulf, L (IEEE, 1995)