Proving multilevel security of a system design (1977)

by R J Feiertag, K N Levitt, L Robinson
Venue:In 6th ACM Symp. Operating System Principles