Two Formal Approaches for Approximating Noninterference Properties