A provably secure operating system: The system, its applications, and proof (1980)

by P Neumann, R Boyer, R Feiertag, K Levitt, L Robinson