Specification and Design of Secure Systems (1981)

by J Rushby