A provably secure operating system: The system, its applications, and proofs (1980)

by Peter G Neumann, Robert S Boyer, Richard J Feiertag, Karl N Levitt, Lawrence Robinson