Confidentiality Properties and the B Method