A model for verification of data security in operating systems (1978)

by G Popek, D Farber
Venue:Communications of the ACM