Confidentiality in a replicated architecture trusted database system: a formal model | IEEE Conference Publication | IEEE Xplore