Noninterference specifications for secure systems