A Provably Secure Operating System: The system, its applications, and proofs (1980)

by P G Neumann, R S Boyer, R J Feiertag, K N Levitt, L Robinson