Rushby 81a] John Rushby. Proof of Separability: A Verification Technique for a Class of Security Kernels (1977)

by Englewood Cliffs Prentice-Hall, N J